CVE-2008-3529: Buffer Overflow
Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.
Other sources
It was discovered, that libxml2 does not properly handle long XML entity names. In the xmlParseAttValueComplex() function in parser.c, when entity name is not substituted with entity value, but is sent to output unchanged, buffer used to store entity name may not be grown sufficiently in case of long entity names, resulting in a heap buffer overflow.
Issue is already fixed upstream in version 2.7.0.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3529?
CVE-2008-3529 is classified as a high severity vulnerability due to its potential to cause denial of service or arbitrary code execution.
How do I fix CVE-2008-3529?
To resolve CVE-2008-3529, update libxml2 to version 2.7.0 or later.
What affected versions are vulnerable for CVE-2008-3529?
CVE-2008-3529 affects libxml2 versions prior to 2.7.0.
What types of attacks can exploit CVE-2008-3529?
CVE-2008-3529 can be exploited by attackers using long XML entity names to cause crashes or execute malicious code.
Which software is impacted by CVE-2008-3529?
CVE-2008-3529 impacts various software including older versions of libxml2, Apple Safari, and several versions of macOS and Linux distributions.