CVE-2015-5312
HighSummary
The xmlStringLenDecodeEntities function in libxml2 before version 2.9.3 does not properly prevent entity expansion, allowing context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.
Risk Assessment
Organizations may experience significant performance issues, leading to denial of service in systems using the vulnerable version of libxml2.
Recommendation
It is recommended to upgrade libxml2 to version 2.9.3 or later to mitigate this vulnerability.
Other vulnerabilities in libxml2
See all- CVE-2017-7013High
An issue was discovered in certain Apple products related to the 'libxml2' component. Affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, tvOS before 10.2.2, and watchOS before 3.2.3.
- CVE-2017-7010High
An issue was discovered in certain Apple products related to the 'libxml2' component. It affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2.
- CVE-2016-4483High
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.
- CVE-2016-4449High
CVE-2016-4449 describes an XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before version 2.9.4. This vulnerability, when not in validating mode, allows attackers to read arbitrary files or cause denial of service through unspecified vectors.
- CVE-2016-4447High
The xmlParseElementDecl function in libxml2 before version 2.9.4 allows context-dependent attackers to cause a denial of service via a crafted file, resulting in heap-based buffer underread and application crash.
- CVE-2016-1840High
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before version 2.9.4 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted XML document.
- CVE-2016-1835High
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before version 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.
- CVE-2016-1834High
Heap-based buffer overflow in the xmlStrncat function in libxml2 before version 2.9.4, used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
- CVE-2016-3705High
The xmlParserEntityCheck and xmlParseAttValueComplex functions in libxml2 2.9.3 do not properly keep track of the recursion depth, allowing context-dependent attackers to cause a denial of service via a crafted XML document containing a large number of nested entity references.
- CVE-2016-3627High
The xmlStringGetNodeList function in libxml2 version 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service through a crafted XML document, leading to infinite recursion, stack consumption, and application crash.
Original NVD description (English source)
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS