CVE-2015-7941: Buffer Overflow
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7941?
CVE-2015-7941 is classified as a denial of service vulnerability due to the potential for out-of-bounds reads and crashes.
How do I fix CVE-2015-7941?
To fix CVE-2015-7941, upgrade libxml2 to a version later than 2.9.2 that addresses this vulnerability.
What software is affected by CVE-2015-7941?
CVE-2015-7941 affects libxml2 version 2.9.2 and Ubuntu Linux versions 12.04, 14.04, and 15.04.
Can CVE-2015-7941 lead to data exposure?
CVE-2015-7941 primarily results in denial of service, not direct data exposure, but the crash may lead to temporary unavailability.
Who can exploit CVE-2015-7941?
CVE-2015-7941 can be exploited by context-dependent attackers who deliver crafted XML data.