CVEvulnerability

CVE-2008-3281

6.5 MEDIUM Published 2008-08-27 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-08-27
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-776

Description

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

Affected configurations

• xmlsoft libxml2 (<= 2.6.32) • apple safari (< 4.0) • apple iphone os (>= 1.0.0 < 3.0) • fedoraproject fedora 9 • canonical ubuntu linux 6.06 • canonical ubuntu linux 7.04 • canonical ubuntu linux 7.10 • canonical ubuntu linux 8.04 • debian debian linux 4.0 • redhat enterprise linux desktop 3.0 • redhat enterprise linux desktop 4.0 • redhat enterprise linux desktop 5.0 • redhat enterprise linux eus 4.7 • redhat enterprise linux eus 5.2 • redhat enterprise linux server 2.0 • redhat enterprise linux server 3.0 • redhat enterprise linux server 4.0 • redhat enterprise linux server 5.0 • redhat enterprise linux workstation 2.0 • redhat enterprise linux workstation 3.0 • redhat enterprise linux workstation 4.0 • redhat enterprise linux workstation 5.0 • vmware esx 2.5.4 • vmware esx 2.5.5 • vmware esx 3.0.2 • vmware esx 3.0.3

Related

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

Referenced by CWE · observed example (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References