CVE-2008-3281: Medium severity libxml2-devel vulnerability
Daniel Veillard discovered that a specially crafted document can lead to a recursive evaluation of entities, the result being an exhaustion of memory and CPU usage
Acknowledgements:
Red Hat would like to thank Andreas Solberg for responsibly disclosing this issue.
Other sources
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3281?
CVE-2008-3281 is classified as a denial of service vulnerability due to excessive memory and CPU consumption.
How do I fix CVE-2008-3281?
To fix CVE-2008-3281, upgrade libxml2 to version 2.6.33 or later.
What software is affected by CVE-2008-3281?
Versions of libxml2 up to and including 2.6.32 are affected by CVE-2008-3281.
What type of attack does CVE-2008-3281 facilitate?
CVE-2008-3281 allows attackers to launch denial of service attacks via specially crafted XML documents.
Is CVE-2008-3281 related to XML processing?
Yes, CVE-2008-3281 is specifically related to improper recursion handling during XML entity expansion.