CVE-2008-4226: Integer Overflow
First published: Fri Nov 07 2008(Updated: )
Created <span class=""><a href="attachment.cgi?id=322841&action=diff" name="attach_322841" title="Proposed patch from Drew Yao">attachment 322841</a> <a href="attachment.cgi?id=322841&action=edit" title="Proposed patch from Drew Yao">[details]</a></span> Proposed patch from Drew Yao Description of problem: Drew Yao from Apple Product Security has reported integer overflow leading to memory corruption present in the xmlSAX2Characters() function in the libxml2 library. User could trigger this flaw by providing very large XML file for parsing to the XML parsing library, which would corrupt the memory and might potentially allow arbitrary code execution. Proposed patch: See attachment. Acknowledgements: Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Libxml2 | =2.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00472.html
- http://secunia.com/advisories/32773
- http://secunia.com/advisories/32807
- http://www.debian.org/security/2008/dsa-1666
- http://secunia.com/advisories/32762
- http://www.ubuntu.com/usn/usn-673-1
- http://securitytracker.com/id?1021238
- https://admin.fedoraproject.org/updates/libxml2-2.7.2-2.fc10
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:231
- http://wiki.rpath.com/Advisories:rPSA-2008-0325
- http://secunia.com/advisories/32766
- http://www.redhat.com/support/errata/RHSA-2008-0988.html
- https://bugzilla.redhat.com/show_bug.cgi?id=470466
- http://www.securityfocus.com/bid/32326
- http://www.osvdb.org/49993
- http://secunia.com/advisories/32764
- http://secunia.com/advisories/32802
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00513.html
- https://admin.fedoraproject.org/updates/libxml2-2.7.2-2.fc9
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473974
- http://secunia.com/advisories/32811
- http://secunia.com/advisories/32872
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
- http://secunia.com/advisories/33417
- http://support.avaya.com/elmodocs2/security/ASA-2009-002.htm
- http://security.gentoo.org/glsa/glsa-200812-06.xml
- http://secunia.com/advisories/32974
- http://www.vmware.com/security/advisories/VMSA-2009-0001.html
- http://secunia.com/advisories/33792
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-251406-1
- http://secunia.com/advisories/33746
- http://support.avaya.com/elmodocs2/security/ASA-2009-067.htm
- http://secunia.com/advisories/34247
- http://secunia.com/advisories/35379
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://www.vupen.com/english/advisories/2009/1522
- http://support.apple.com/kb/HT3613
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://www.vupen.com/english/advisories/2009/1621
- http://support.apple.com/kb/HT3639
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-261688-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1
- http://secunia.com/advisories/36235
- http://secunia.com/advisories/36173
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-141243-01-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-265329-1
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
- http://www.vupen.com/english/advisories/2009/0034
- http://www.vupen.com/english/advisories/2008/3176
- http://www.vupen.com/english/advisories/2009/0323
- http://www.vupen.com/english/advisories/2009/0301
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9888
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6360
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6219
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=322841&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=322841&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=322844&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=322844&action=edit
- http://admin.fedoraproject.org/updates/libxml2-2.7.2-2.fc9
- http://admin.fedoraproject.org/updates/libxml2-2.7.2-2.fc10
- http://rhn.redhat.com/errata/RHSA-2008-0988.html
- https://admin.fedoraproject.org/updates/F8/FEDORA-2008-9729
- https://admin.fedoraproject.org/updates/F9/FEDORA-2008-9773
- https://admin.fedoraproject.org/updates/f10/FEDORA-2008-10038
Frequently Asked Questions
What is the severity of CVE-2008-4226?
CVE-2008-4226 has a severity rating of moderate, reflecting potential risks in the affected software.
How do I fix CVE-2008-4226?
To fix CVE-2008-4226, upgrade the affected software, specifically libxml version 2.7.2 or later.
Which software is affected by CVE-2008-4226?
CVE-2008-4226 primarily affects libxml version 2.7.2.
What type of vulnerability is CVE-2008-4226?
CVE-2008-4226 is categorized as a security vulnerability affecting XML parsing.
Is there a known exploit for CVE-2008-4226?
There are no widely reported exploits for CVE-2008-4226, but it is advisable to apply the patch as a precaution.
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/remedy
- agent/author
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-4226
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/xmlsoft
- canonical/libxml2
- version/libxml2/2.7.2