Lucene search

K
osvGoogleOSV:DLA-80-1
HistoryOct 29, 2014 - 12:00 a.m.

libxml2 - security update

2014-10-2900:00:00
Google
osv.dev
15

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.015 Low

EPSS

Percentile

84.8%

Sogeti found a denial of service flaw in libxml2, a library providing
support to read, modify and write XML and HTML files. A remote attacker
could provide a specially crafted XML file that, when processed by an
application using libxml2, would lead to excessive CPU consumption
(denial of service) based on excessive entity substitutions, even if
entity substitution was disabled, which is the parser default behavior.
(CVE-2014-3660)

In addition, this update addresses a misapplied chunk for a patch
released the previous version (#762864).

For Debian 6 Squeeze, these issues have been fixed in libxml2 version 2.7.8.dfsg-2+squeeze10

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.015 Low

EPSS

Percentile

84.8%