CVE-2008-4409: Medium severity libxml2-devel vulnerability

Published Oct 3, 2008

Updated

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

Affected Software

2 affected components

XMLSoft Libxml2=2.7.1

XMLSoft Libxml2=2.7.0

Event History

Oct 3, 2008

CVE Published

via MITRE·05:18 PM

Data Sourced

via MITRE·05:18 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-4409?

CVE-2008-4409 is classified as a denial of service vulnerability that can lead to memory consumption and application crashes.

How do I fix CVE-2008-4409?

To remediate CVE-2008-4409, upgrade libxml2 to version 2.7.2 or later.

What versions of libxml2 are affected by CVE-2008-4409?

CVE-2008-4409 affects libxml2 versions 2.7.0 and 2.7.1.

What types of attacks are possible with CVE-2008-4409?

CVE-2008-4409 allows context-dependent attackers to cause denial of service by exploiting predefined entity definitions.

Can CVE-2008-4409 be exploited through XML documents?

Yes, CVE-2008-4409 can be exploited using specific XML documents that cause the application to crash.