REDHAT-BUG-1281930
First published: Fri Nov 13 2015(Updated: )
An out-of-bounds heap read in xmlParseXMLDecl happens when a file containing unfinished xml declaration, e.g. <?xml versionencoding="ISO88598", is followed by 0xff byte. Upstream bug: <a href="https://bugzilla.gnome.org/show_bug.cgi?id=751631">https://bugzilla.gnome.org/show_bug.cgi?id=751631</a> Upstream patch: <a href="https://git.gnome.org/browse/libxml2/commit/?id=709a952110e98621c9b78c4f26462a9d8333102e">https://git.gnome.org/browse/libxml2/commit/?id=709a952110e98621c9b78c4f26462a9d8333102e</a> Out-of-bounds heap read also occurs in xmlParseXMLDecl when file contains unterminated encoding value. Upstream bug: <a href="https://bugzilla.gnome.org/show_bug.cgi?id=751603">https://bugzilla.gnome.org/show_bug.cgi?id=751603</a> Upstream patch: <a href="https://git.gnome.org/browse/libxml2/commit/?id=9aa37588ee78a06ca1379a9d9356eab16686099c">https://git.gnome.org/browse/libxml2/commit/?id=9aa37588ee78a06ca1379a9d9356eab16686099c</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| libxml2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.gnome.org/show_bug.cgi?id=751631
- https://git.gnome.org/browse/libxml2/commit/?id=709a952110e98621c9b78c4f26462a9d8333102e
- https://bugzilla.gnome.org/show_bug.cgi?id=751603
- https://git.gnome.org/browse/libxml2/commit/?id=9aa37588ee78a06ca1379a9d9356eab16686099c
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1281931
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1281932
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1281933
- http://seclists.org/oss-sec/2015/q4/354
- https://rhn.redhat.com/errata/RHSA-2015-2549.html
- https://rhn.redhat.com/errata/RHSA-2015-2550.html
- https://rhn.redhat.com/errata/RHSA-2016-1089.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1281930
Frequently Asked Questions
What is the severity of REDHAT-BUG-1281930?
The severity of REDHAT-BUG-1281930 is classified as a high-risk vulnerability due to the potential for exploitation.
How do I fix REDHAT-BUG-1281930?
To fix REDHAT-BUG-1281930, update to the latest version of libxml2 that addresses this out-of-bounds heap read issue.
What software is affected by REDHAT-BUG-1281930?
The affected software for REDHAT-BUG-1281930 is GNOME's libxml2.
What causes the vulnerability REDHAT-BUG-1281930?
The vulnerability REDHAT-BUG-1281930 is caused by an out-of-bounds heap read during XML parsing when encountering an unfinished XML declaration.
Is there a known exploit for REDHAT-BUG-1281930?
As of now, there are no public exploits known for REDHAT-BUG-1281930, but the potential for exploitation exists.
- agent/type
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-8317
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gnome
- canonical/libxml2