CVE-2015-8317: Buffer Overflow
An out-of-bounds heap read in xmlParseXMLDecl happens when a file containing unfinished xml declaration, e.g. <?xml versionencoding="ISO88598", is followed by 0xff byte.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=751631
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=709a952110e98621c9b78c4f26462a9d8333102e
Out-of-bounds heap read also occurs in xmlParseXMLDecl when file contains unterminated encoding value.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=751603
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=9aa37588ee78a06ca1379a9d9356eab16686099c
Other sources
The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8317?
CVE-2015-8317 has been classified as a moderate severity vulnerability due to its potential to cause out-of-bounds read issues.
How do I fix CVE-2015-8317?
To fix CVE-2015-8317, update to the latest version of libxml2 that addresses this vulnerability.
What systems are affected by CVE-2015-8317?
CVE-2015-8317 affects Debian 7.0 and 8.0, Ubuntu 12.04, 14.04, 15.04, 15.10, and various versions of Red Hat Enterprise Linux 6.0.
What is the impact of exploiting CVE-2015-8317?
Exploiting CVE-2015-8317 could allow an attacker to read sensitive memory content, leading to potential information disclosure.
Where can more details about CVE-2015-8317 be found?
More details about CVE-2015-8317 can typically be found in security bulletins from affected software vendors and vulnerability databases.