CVE-2016-3627

Опубликовано: 17 мая 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.

Ссылки

http://lists.opensuse.org/opensuse-updates/2016-05/msg00055.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2016-05/msg00127.html
Mailing List
http://rhn.redhat.com/errata/RHSA-2016-2957.html
Third Party Advisory
http://seclists.org/fulldisclosure/2016/May/10
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/21/2
Mailing List
Patch
http://www.openwall.com/lists/oss-security/2016/03/21/3
Mailing List
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
Patch
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Patch
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Patch
Third Party Advisory
http://www.securityfocus.com/bid/84992
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1035335
Broken Link
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-2994-1
Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1292
Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157239
Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10170
Broken Link
https://security.gentoo.org/glsa/201701-37
Third Party Advisory
https://www.debian.org/security/2016/dsa-3593
Mailing List
https://www.tenable.com/security/tns-2016-18
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-05/msg00055.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2016-05/msg00127.html
Mailing List

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:hp:icewall_federation_agent:3.0:*:*:*:*:*:*:*

cpe:2.3:a:hp:icewall_file_manager:3.0:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*

Версия до 2.9.3 (включая)

Конфигурация 5

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 7

Одно из

cpe:2.3:a:oracle:vm_server:3.3:*:*:*:*:*:x86:*

cpe:2.3:a:oracle:vm_server:3.4:*:*:*:*:*:x86:*

cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

EPSS

Процентиль: 50%

0.00263

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-674

Связанные уязвимости

CVE-2016-3627

CVSS3: 7.5

ubuntu

больше 9 лет назад

CVE-2016-3627

redhat

больше 9 лет назад

CVE-2016-3627

CVSS3: 7.5

debian

больше 9 лет назад

The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earli ...

openSUSE-SU-2016:1298-1

suse-cvrf

больше 9 лет назад

Security update for libxml2

SUSE-SU-2016:1205-1

suse-cvrf

больше 9 лет назад

Security update for libxml2

EPSS

Процентиль: 50%

0.00263

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-674