Executive Summary
Summary | |
---|---|
Title | libxml2 vulnerability |
Informations | |||
---|---|---|---|
Name | USN-640-1 | First vendor Publication | 2008-09-03 |
Vendor | Ubuntu | Last vendor Modification | 2008-09-03 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: Ubuntu 7.04: Ubuntu 7.10: Ubuntu 8.04 LTS: In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Andreas Solberg discovered that libxml2 did not handle recursive entities safely. If an application linked against libxml2 were made to process a specially crafted XML document, a remote attacker could exhaust the system's CPU resources, leading to a denial of service. |
Original Source
Url : http://www.ubuntu.com/usn/USN-640-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-776 | Unrestricted Recursive Entity References in DTDs ('XML Bomb') |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:17731 | |||
Oval ID: | oval:org.mitre.oval:def:17731 | ||
Title: | USN-644-1 -- libxml2 vulnerabilities | ||
Description: | It was discovered that libxml2 did not correctly handle long entity names. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-644-1 CVE-2008-3529 CVE-2008-3281 | Version: | 7 |
Platform(s): | Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 | Product(s): | libxml2 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:17756 | |||
Oval ID: | oval:org.mitre.oval:def:17756 | ||
Title: | USN-640-1 -- libxml2 vulnerability | ||
Description: | Andreas Solberg discovered that libxml2 did not handle recursive entities safely. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-640-1 CVE-2008-3281 | Version: | 7 |
Platform(s): | Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 | Product(s): | libxml2 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:19740 | |||
Oval ID: | oval:org.mitre.oval:def:19740 | ||
Title: | DSA-1631-1 libxml2 - denial of service | ||
Description: | Andreas Solberg discovered that libxml2, the GNOME XML library, could be forced to recursively evaluate entities, until available CPU and memory resources were exhausted. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1631-1 CVE-2008-3281 | Version: | 5 |
Platform(s): | Debian GNU/Linux 4.0 | Product(s): | libxml2 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:21731 | |||
Oval ID: | oval:org.mitre.oval:def:21731 | ||
Title: | ELSA-2008:0836: libxml2 security update (Moderate) | ||
Description: | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2008:0836-04 CVE-2008-3281 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | libxml2 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:29241 | |||
Oval ID: | oval:org.mitre.oval:def:29241 | ||
Title: | RHSA-2008:0836 -- libxml2 security update (Moderate) | ||
Description: | Updated libxml2 packages that fix a security issue are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The original fix used in this errata caused some applications using the libxml2 library in an unexpected way to crash when used with updated libxml2 packages. We have updated the packages for Red Hat Enterprise Linux 3, 4 and 5 to use a different fix that does not break affected applications. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2008:0836 CESA-2008:0836-CentOS 3 CESA-2008:0836-CentOS 2 CESA-2008:0836-CentOS 5 CVE-2008-3281 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 3 CentOS Linux 2 CentOS Linux 5 | Product(s): | libxml2 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:6496 | |||
Oval ID: | oval:org.mitre.oval:def:6496 | ||
Title: | Libxml2 Recursive Entity Evaluation Bug Lets Remote Users Deny Service | ||
Description: | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2008-3281 | Version: | 3 |
Platform(s): | VMWare ESX Server 3 VMWare ESX Server 3.5 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7968 | |||
Oval ID: | oval:org.mitre.oval:def:7968 | ||
Title: | DSA-1631 libxml2 -- denial of service | ||
Description: | Andreas Solberg discovered that libxml2, the GNOME XML library, could be forced to recursively evaluate entities, until available CPU and memory resources were exhausted. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1631 CVE-2008-3281 | Version: | 3 |
Platform(s): | Debian GNU/Linux 4.0 | Product(s): | libxml2 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9812 | |||
Oval ID: | oval:org.mitre.oval:def:9812 | ||
Title: | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. | ||
Description: | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2008-3281 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-13 | Name : SLES10: Security update for libxml2 File : nvt/sles10_libxml2.nasl |
2009-10-10 | Name : SLES9: Security update for libxml2 File : nvt/sles9p5035440.nasl |
2009-04-09 | Name : Mandriva Update for libxml2 MDVSA-2008:180 (libxml2) File : nvt/gb_mandriva_MDVSA_2008_180.nasl |
2009-04-09 | Name : Mandriva Update for libxml2 MDVSA-2008:180-1 (libxml2) File : nvt/gb_mandriva_MDVSA_2008_180_1.nasl |
2009-04-09 | Name : Mandriva Update for libxml2 MDVSA-2008:192 (libxml2) File : nvt/gb_mandriva_MDVSA_2008_192.nasl |
2009-03-23 | Name : Ubuntu Update for libxml2 vulnerability USN-640-1 File : nvt/gb_ubuntu_USN_640_1.nasl |
2009-03-23 | Name : Ubuntu Update for libxml2 vulnerabilities USN-644-1 File : nvt/gb_ubuntu_USN_644_1.nasl |
2009-03-06 | Name : RedHat Update for libxml2 RHSA-2008:0836-02 File : nvt/gb_RHSA-2008_0836-02_libxml2.nasl |
2009-02-27 | Name : CentOS Update for libxml2 CESA-2008:0836-02 centos2 i386 File : nvt/gb_CESA-2008_0836-02_libxml2_centos2_i386.nasl |
2009-02-27 | Name : CentOS Update for libxml2 CESA-2008:0836 centos3 i386 File : nvt/gb_CESA-2008_0836_libxml2_centos3_i386.nasl |
2009-02-27 | Name : CentOS Update for libxml2 CESA-2008:0836 centos3 x86_64 File : nvt/gb_CESA-2008_0836_libxml2_centos3_x86_64.nasl |
2009-02-17 | Name : Fedora Update for libxml2 FEDORA-2008-7395 File : nvt/gb_fedora_2008_7395_libxml2_fc9.nasl |
2009-02-17 | Name : Fedora Update for libxml2 FEDORA-2008-7724 File : nvt/gb_fedora_2008_7724_libxml2_fc8.nasl |
2008-12-03 | Name : Gentoo Security Advisory GLSA 200812-06 (libxml2) File : nvt/glsa_200812_06.nasl |
2008-11-01 | Name : FreeBSD Ports: libxml2 File : nvt/freebsd_libxml20.nasl |
2008-09-04 | Name : Debian Security Advisory DSA 1631-1 (libxml2) File : nvt/deb_1631_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
47636 | libxml2 Crafted XML File Handling Recursion Limit DoS |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2008-11-06 | IAVM : 2008-B-0078 - Multiple Vulnerabilities in VMware Severity : Category I - VMSKEY : V0017874 |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2009-0018.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0836.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080821_libxml2_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12237.nasl - Type : ACT_GATHER_INFO |
2009-07-27 | Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2008-0017.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_libxml2-080905.nasl - Type : ACT_GATHER_INFO |
2009-06-09 | Name : The remote host contains a web browser that is affected by several vulnerabil... File : macosx_Safari4_0.nasl - Type : ACT_GATHER_INFO |
2009-06-09 | Name : The remote host contains a web browser that is affected by several vulnerabil... File : safari_4.0.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-180.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-192.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-644-1.nasl - Type : ACT_GATHER_INFO |
2008-12-03 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200812-06.nasl - Type : ACT_GATHER_INFO |
2008-10-15 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_d71da2369a9411dd8f42001c2514716c.nasl - Type : ACT_GATHER_INFO |
2008-09-15 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libxml2-5583.nasl - Type : ACT_GATHER_INFO |
2008-09-15 | Name : The remote openSUSE host is missing a security update. File : suse_libxml2-5586.nasl - Type : ACT_GATHER_INFO |
2008-09-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-7724.nasl - Type : ACT_GATHER_INFO |
2008-09-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-7395.nasl - Type : ACT_GATHER_INFO |
2008-09-05 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-640-1.nasl - Type : ACT_GATHER_INFO |
2008-08-27 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0836.nasl - Type : ACT_GATHER_INFO |
2008-08-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1631.nasl - Type : ACT_GATHER_INFO |
2008-08-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0836.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 12:05:16 |
|