CVE-2015-8242: Buffer Overflow
Stack-based buffer overread vulnerability with HTML parser in push mode in xmlSAX2TextNode causing segmentation fault when compiled with ASAN.
Upstream bug (containing reproducer):
https://bugzilla.gnome.org/showbug.cgi?id=756372
Other sources
The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8242?
CVE-2015-8242 has a severity rating that indicates it can lead to denial of service and sensitive information disclosure.
How do I fix CVE-2015-8242?
To fix CVE-2015-8242, upgrade libxml2 to version 2.9.3 or later.
Which software is affected by CVE-2015-8242?
CVE-2015-8242 affects various software including libxml2 versions prior to 2.9.3 and specific versions of HP IceWall Federation Agent and File Manager.
Can CVE-2015-8242 cause data loss?
CVE-2015-8242 primarily leads to application crashes, which may result in temporary data loss during the incident.
What type of attack is associated with CVE-2015-8242?
CVE-2015-8242 is associated with context-dependent attacks that exploit crafted XML data to cause buffer over-reads.