SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Libxml2 Vendors:   xmlsoft.org
Libxml2 UTF-8 Validation Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID:  1019181
SecurityTracker URL:  http://securitytracker.com/id/1019181
CVE Reference:   CVE-2007-6284   (Links to External Site)
Updated:  Jan 11 2008
Original Entry Date:  Jan 11 2008
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 2.6.31
Description:   A vulnerability was reported in Libxml2. A remote user can cause denial of service conditions.

A remote user can send specially crafted data to a target application that uses the libxml UTF-8 decoding function to cause the library to enter an infinite loop.

The vulnerability resides in the xmlCurrentChar() function and can be triggered by certain multibyte combinations.

Brad Fitzpatrick of Google reported this vulnerability.

Impact:   A remote user can cause the target application to enter an infinite loop and consume excessive CPU resources on the target system.
Solution:   The vendor has issued a fixed version (2.6.31).
Vendor URL:  www.xmlsoft.org/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jan 11 2008 (Red Hat Issues Fix) Libxml2 UTF-8 Validation Flaw Lets Remote Users Deny Service
Red Hat has released a fix for Red Hat Enterprise Linux 2.1, 3, 4, and 5.
Jan 16 2008 (Sun Issues Fix) Libxml2 UTF-8 Validation Flaw Lets Remote Users Deny Service
Sun has issued a fix for Solaris 9 and 10.
Mar 31 2008 (VMware Issues Fix for VMware ESX) Libxml2 UTF-8 Validation Flaw Lets Remote Users Deny Service
VMware has issued a fix for VMware ESX 2.5.4 and 2.5.5.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC