CVE-2008-4225: Integer Overflow
Created attachment 322846 [details] Proposed patch from Drew Yao
Description of problem:
Drew Yao of Apple Product Security has reported an integer overflow present in xmlBufferResize function in the libxml2 library potentially leading to an infinite loop. User could provide a very large XML file for parsing to the XML parsing library, which could allow him to cause a denial of service.
Proposed patch: See attachment.
Acknowledgements:
Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.
Other sources
Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4225?
CVE-2008-4225 has been classified as a medium severity vulnerability.
How do I fix CVE-2008-4225?
To fix CVE-2008-4225, upgrade Libxml2 to version 2.7.3 or higher.
What software is affected by CVE-2008-4225?
CVE-2008-4225 affects Libxml2 version 2.7.2.
Is CVE-2008-4225 exploitable remotely?
Yes, CVE-2008-4225 can be exploited remotely under certain conditions.
What kind of vulnerability is CVE-2008-4225?
CVE-2008-4225 is a vulnerability related to improper processing of XML data.