GoogleOSV:DSA-1654-1libxml2 - execution of arbitrary code
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
It was discovered that libxml2, the GNOME XML library, didnât correctly
handle long entity names. This could allow the execution of arbitrary
code via a malicious XML file.
For the stable distribution (etch), this problem has been fixed in version
2.6.27.dfsg-5.
For the unstable distribution (sid), this problem has been fixed in
version 2.6.32.dfsg-4.
We recommend that you upgrade your libxml2 package.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libxml2 | eq | 2.6.27.dfsg-2 | |
| libxml2 | eq | 2.6.27.dfsg-3 | |
| libxml2 | eq | 2.6.27.dfsg-1 | |
| libxml2 | eq | 2.6.27.dfsg-4 |
References
Related
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C