REDHAT-BUG-2429933: Low severity libxml2 vulnerability
Uncontrolled recursion vulnerability in the RelaxNG include handling logic of the libxml2 XML parsing library. The issue arises from the absence of limits on recursive <include> directive resolution. When a deeply nested chain of included RelaxNG schema files is processed, the parser enters unbounded recursion, eventually exhausting the system call stack. This results in a stack overflow and application crash. Exploitation requires attacker-controlled schema input and primarily impacts availability by causing a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2429933?
The severity of REDHAT-BUG-2429933 is considered high due to the potential for a denial-of-service condition caused by unbounded recursion.
How do I fix REDHAT-BUG-2429933?
To fix REDHAT-BUG-2429933, update to the latest version of libxml2 that contains the patch for this vulnerability.
What software is affected by REDHAT-BUG-2429933?
The affected software for REDHAT-BUG-2429933 is the libxml2 XML parsing library.
What causes the vulnerability in REDHAT-BUG-2429933?
The vulnerability in REDHAT-BUG-2429933 is caused by the lack of limits on recursive include directive resolution in the RelaxNG schema processing.
Can REDHAT-BUG-2429933 be exploited remotely?
Yes, REDHAT-BUG-2429933 can potentially be exploited remotely if an attacker can manipulate the included RelaxNG schema files.