CVE-2015-7498: Buffer Overflow
Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.
Other sources
Heap-based buffer overflow was found in xmlParseXmlDecl. When conversion failure happens, parser continues to extract more errors which may lead to unexpected behaviour.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=756527
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=afd27c21f6b36e22682b7da20d726bce2dcb2f43
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7498?
CVE-2015-7498 has a severity rating that could allow a denial of service due to heap-based buffer overflow.
How do I fix CVE-2015-7498?
To fix CVE-2015-7498, upgrade to libxml2 version 2.9.3 or later.
Which software is affected by CVE-2015-7498?
CVE-2015-7498 affects libxml2 versions prior to 2.9.3, as well as various software including HP IceWall Federation Agent 3.0 and Ubuntu Linux versions 12.04 to 15.10.
What type of vulnerability is CVE-2015-7498?
CVE-2015-7498 is a heap-based buffer overflow vulnerability.
Can CVE-2015-7498 be exploited remotely?
Yes, CVE-2015-7498 can potentially be exploited by context-dependent attackers through specific vectors.