CVE-2015-5312: High severity ubuntu vulnerability
A vulnerability in libxml2 was found causing DoS by exhausting CPU when parsing specially crafted XML document.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=756733
Other sources
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 (as used in nokogiri before 1.6.7.1) does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5312?
CVE-2015-5312 is considered a medium-severity vulnerability due to its potential to cause denial of service by exhausting CPU resources.
How do I fix CVE-2015-5312?
To fix CVE-2015-5312, update the libxml2 library to a version greater than 2.9.2 or upgrade to a patched version of affected software packages.
What software is impacted by CVE-2015-5312?
CVE-2015-5312 affects various software including Nokogiri, libxml2, and multiple versions of Ubuntu and Red Hat Linux.
What type of vulnerability is CVE-2015-5312?
CVE-2015-5312 is a denial-of-service vulnerability caused by parsing specially crafted XML documents.
Can CVE-2015-5312 be exploited remotely?
Yes, CVE-2015-5312 can be exploited remotely if a vulnerable application processes untrusted XML input.