阿里云漏洞库

漏洞描述

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://bugzilla.gnome.org/show_bug.cgi?id=554660
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
http://openwall.com/lists/oss-security/2008/10/02/4
http://secunia.com/advisories/32130
http://secunia.com/advisories/32175
http://secunia.com/advisories/32974
http://secunia.com/advisories/35379
http://security.gentoo.org/glsa/glsa-200812-06.xml
http://support.apple.com/kb/HT3613
http://support.apple.com/kb/HT3639
http://www.mandriva.com/security/advisories?name=MDVSA-2008:212
http://www.securityfocus.com/bid/31555
http://www.vupen.com/english/advisories/2009/1522
http://www.vupen.com/english/advisories/2009/1621
https://exchange.xforce.ibmcloud.com/vulnerabilities/45633
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00125.html
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00130.html

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	xmlsoft	libxml2	2.7.0	-
	运行在以下环境
	应用	xmlsoft	libxml2	2.7.1	-
	运行在以下环境
	系统	debian_10	libxml2	*		Up to (excluding) 2.9.4+dfsg1-7+deb10u4
	运行在以下环境
	系统	debian_11	libxml2	*		Up to (excluding) 2.9.10+dfsg-6.7+deb11u4
	运行在以下环境
	系统	debian_12	libxml2	*		Up to (excluding) 2.9.14+dfsg-1.3~deb12u1
	运行在以下环境
	系统	suse_12	libxml2-2	*		Up to (excluding) 2.9.1-6

攻击路径

本地
攻击复杂度

困难
权限要求

普通权限
影响范围

有限影响
EXP成熟度

POC 已公开
补丁情况

官方补丁
数据保密性

无影响
数据完整性

N/A
服务器危害

无影响
全网数量

N/A

CWE-ID	漏洞类型
CWE-399	资源管理错误

中危 libxml2 - Denial of Service

漏洞描述

解决建议

参考链接

受影响软件情况