CVE-2008-4226: Integer Overflow
Created attachment 322841 [details] Proposed patch from Drew Yao
Description of problem:
Drew Yao from Apple Product Security has reported integer overflow leading to memory corruption present in the xmlSAX2Characters() function in the libxml2 library. User could trigger this flaw by providing very large XML file for parsing to the XML parsing library, which would corrupt the memory and might potentially allow arbitrary code execution.
Proposed patch: See attachment.
Acknowledgements:
Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.
Other sources
Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4226?
CVE-2008-4226 has a severity rating of moderate, reflecting potential risks in the affected software.
How do I fix CVE-2008-4226?
To fix CVE-2008-4226, upgrade the affected software, specifically libxml version 2.7.2 or later.
Which software is affected by CVE-2008-4226?
CVE-2008-4226 primarily affects libxml version 2.7.2.
What type of vulnerability is CVE-2008-4226?
CVE-2008-4226 is categorized as a security vulnerability affecting XML parsing.
Is there a known exploit for CVE-2008-4226?
There are no widely reported exploits for CVE-2008-4226, but it is advisable to apply the patch as a precaution.