Veracode Vulnerability DatabaseVERACODE:6363Denial Of Service (DoS)
EPSS
Percentile
84.4%
libxml2.so is vulnerable to denial of service. The vulnerability exists in the xmlParserEntityCheck and xmlParseAttValueComplex functions that calls xmlStringDecodeEntities recursively without incrementing the depth counter, causing a stack buffer overflow attack which then lead to an application crash.
References
lists.opensuse.org/opensuse-updates/2016-05/msg00055.html
lists.opensuse.org/opensuse-updates/2016-05/msg00127.html
rhn.redhat.com/errata/RHSA-2016-2957.html
seclists.org/fulldisclosure/2016/May/10
www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
www.securityfocus.com/bid/89854
www.ubuntu.com/usn/USN-2994-1
access.redhat.com/errata/RHSA-2016:1292
access.redhat.com/errata/RHSA-2016:2957
access.redhat.com/security/cve/CVE-2016-3705
bugzilla.gnome.org/show_bug.cgi?id=765207
bugzilla.redhat.com/show_bug.cgi?id=1332443
git.gnome.org/browse/libxml2/commit/?h=CVE-2016-3705&id=8f30bdff69edac9075f4663ce3b56b0c52d48ce6
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157239
kc.mcafee.com/corporate/index?page=content&id=SB10170
security.gentoo.org/glsa/201701-37
www.debian.org/security/2016/dsa-3593
www.tenable.com/security/tns-2016-18
Related
