REDHAT-BUG-880466: Buffer Overflow

Published Nov 27, 2012

Updated

A heap-buffer overflow was found in the way libxml2 decoded certain XML entitites. A remote attacker could provide a specially-crafted XML file, which once opened in an application linked against libxml would cause that application to crash, or, potentially, execute arbitrary code with the privileges of the user running the application.

Reference: http://googlechromereleases.blogspot.in/2012/11/stable-channel-update.html

Patch: http://git.gnome.org/browse/libxml2/commit/?id=6a36fbe3b3e001a8a840b5c1fdd81cefc9947f0d

Affected Software

1 affected component

Gnome libxml2

Event History

Nov 27, 2012

Data Sourced

via Red Hat·04:18 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-880466?

The vulnerability REDHAT-BUG-880466 is classified as critical due to the potential for remote code execution.

How do I fix REDHAT-BUG-880466?

To fix REDHAT-BUG-880466, update libxml2 to the latest version provided by your distribution.

What applications are affected by REDHAT-BUG-880466?

Applications linked against the vulnerable version of libxml2 are susceptible to the heap-buffer overflow vulnerability in REDHAT-BUG-880466.

What can an attacker do with REDHAT-BUG-880466?

An attacker can exploit REDHAT-BUG-880466 to crash affected applications or execute arbitrary code with the application's privileges.

Is there a workaround for REDHAT-BUG-880466?

There are no known workarounds for REDHAT-BUG-880466 other than upgrading to a patched version of libxml2.