CVE-2015-8241: Buffer Overflow
A buffer overread in xmlNextChar was found, causing segmentation fault when compiled with ASAN.
Upstream bug (contains reproducer):
https://bugzilla.gnome.org/showbug.cgi?id=756263
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe
Other sources
The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8241?
CVE-2015-8241 is classified as a high severity vulnerability due to its potential to cause a segmentation fault.
What systems are affected by CVE-2015-8241?
CVE-2015-8241 affects various versions of Debian Linux, Red Hat Enterprise Linux, and Ubuntu Linux that utilize vulnerable versions of libxml2.
How do I fix CVE-2015-8241?
To fix CVE-2015-8241, update the libxml2 library to a version newer than 2.9.2 which has the vulnerability patched.
What kind of vulnerability is CVE-2015-8241?
CVE-2015-8241 is a buffer overread vulnerability found in the xmlNextChar function.
Is CVE-2015-8241 a remotely exploitable vulnerability?
CVE-2015-8241 may be exploited remotely depending on the application using the affected libxml2 library.