SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Libxml2 Vendors:   xmlsoft.org
(Sun Issues Fix) Libxml2 UTF-8 Validation Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID:  1019195
SecurityTracker URL:  http://securitytracker.com/id/1019195
CVE Reference:   CVE-2007-6284   (Links to External Site)
Updated:  Feb 14 2008
Original Entry Date:  Jan 16 2008
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 2.6.31
Description:   A vulnerability was reported in Libxml2. A remote user can cause denial of service conditions.

A remote user can send specially crafted data to a target application that uses the libxml UTF-8 decoding function to cause the library to enter an infinite loop.

The vulnerability resides in the xmlCurrentChar() function and can be triggered by certain multibyte combinations.

Brad Fitzpatrick of Google reported this vulnerability.

Impact:   A remote user can cause the target application to enter an infinite loop and consume excessive CPU resources on the target system.
Solution:   Sun has issued the following fixes.

SPARC Platform

* Solaris 9 with patch 114014-18 or later
* Solaris 10 with patch 125731-02 or later

x86 Platform

* Solaris 9 with patch 114015-18 or later
* Solaris 10 with patch 125732-02 or later

The Sun advisory is available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201514-1

Vendor URL:  www.xmlsoft.org/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  UNIX (Solaris - SunOS)
Underlying OS Comments:  9, 10

Message History:   This archive entry is a follow-up to the message listed below.
Jan 11 2008 Libxml2 UTF-8 Validation Flaw Lets Remote Users Deny Service



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC