CVE-2011-3102

MEDIUM
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

References

http://code.google.com/p/chromium/issues/detail?id=125462

http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html

http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html

http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00017.html

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html

http://rhn.redhat.com/errata/RHSA-2013-0217.html

http://secunia.com/advisories/49243

http://secunia.com/advisories/50658

http://secunia.com/advisories/54886

http://secunia.com/advisories/55568

http://support.apple.com/kb/HT5934

http://support.apple.com/kb/HT6001

http://www.debian.org/security/2012/dsa-2479

http://www.mandriva.com/security/advisories?name=MDVSA-2012:098

http://www.mandriva.com/security/advisories?name=MDVSA-2013:056

http://www.securityfocus.com/bid/53540

http://www.securitytracker.com/id?1027067

http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf

https://exchange.xforce.ibmcloud.com/vulnerabilities/75607

https://lists.opensuse.org/opensuse-updates/2012-06/msg00011.html

Details

Source: MITRE

Published: 2012-05-16

Updated: 2017-12-29

Type: CWE-189

Risk Information

CVSS v2

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to 19.0.1084.45 (inclusive)

Configuration 2

OR

cpe:2.3:o:apple:iphone_os:1.0.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:1.0.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:1.0.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:1.1.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:1.1.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:1.1.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:1.1.3:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:1.1.4:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:1.1.5:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:2.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:2.0.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:2.0.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:2.0.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:2.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:2.1.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:2.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:2.2.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:3.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:3.0.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:3.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:3.1.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:3.1.3:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:3.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:3.2.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:3.2.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.0.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.0.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.2.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.2.5:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.2.8:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.3.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.3.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.3.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.3.3:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:4.3.5:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:5.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:5.0.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:5.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:5.1.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:6.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:6.0.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:6.0.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:6.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:6.1.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:6.1.3:*:*:*:*:*:*:*

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* versions up to 6.1.4 (inclusive)

Tenable Plugins

View all (37 total)

IDNameProductFamilySeverity
89661VMware ESX / ESXi Authentication Service and Third-Party Libraries Multiple Vulnerabilities (VMSA-2013-0001) (remote check)NessusMisc.
critical
83599SUSE SLES10 Security Update : libxml2 (SUSE-SU-2013:1627-1)NessusSuSE Local Security Checks
high
80688Oracle Solaris Third-Party Patch Update : libxml2 (cve_2011_0216_denial_of)NessusSolaris Local Security Checks
high
74650openSUSE Security Update : libxml2 (openSUSE-SU-2012:0731-1)NessusSuSE Local Security Checks
medium
74634openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0656-1)NessusSuSE Local Security Checks
critical
72105Apple iTunes < 11.1.4 Multiple Vulnerabilities (uncredentialed check)NessusPeer-To-Peer File Sharing
high
72104Apple iTunes < 11.1.4 Multiple Vulnerabilities (credentialed check)NessusWindows
high
70886ESXi 5.1 < Build 1063671 Multiple Vulnerabilities (remote check)NessusMisc.
medium
70877ESXi 5.0 < Build 1022489 Multiple Vulnerabilities (remote check)NessusMisc.
high
70589Apple iTunes < 11.1.2 Multiple Vulnerabilities (uncredentialed check)NessusPeer-To-Peer File Sharing
high
70588Apple iTunes < 11.1.2 Multiple Vulnerabilities (credentialed check)NessusWindows
high
70257Apple TV < 6.0 Multiple VulnerabilitiesNessusMisc.
high
69984Apple iOS < 7 Multiple VulnerabilitiesNessusMobile Devices
high
69624Amazon Linux AMI : libxml2 (ALAS-2012-134)NessusAmazon Linux Local Security Checks
medium
68721Oracle Linux 6 : mingw32-libxml2 (ELSA-2013-0217)NessusOracle Linux Local Security Checks
high
68629Oracle Linux 5 / 6 : libxml2 (ELSA-2012-1288)NessusOracle Linux Local Security Checks
medium
66070Mandriva Linux Security Advisory : libxml2 (MDVSA-2013:056)NessusMandriva Local Security Checks
medium
64642VMSA-2013-0001 : VMware vSphere security updates for the authentication service and third-party librariesNessusVMware ESX Local Security Checks
critical
64425Scientific Linux Security Update : mingw32-libxml2 on SL6.x (x86_64) (20130131)NessusScientific Linux Local Security Checks
high
64391RHEL 6 : mingw32-libxml2 (RHSA-2013:0217)NessusRed Hat Local Security Checks
high
64384CentOS 6 : mingw32-libxml2 (CESA-2013:0217)NessusCentOS Local Security Checks
high
8095iTunes for Windows < 11.1.4 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
64204SuSE 11.1 Security Update : libxml2 (SAT Patch Number 6365)NessusSuSE Local Security Checks
medium
62324Fedora 16 : libxml2-2.7.8-8.fc16 (2012-13824)NessusFedora Local Security Checks
high
62323Fedora 17 : libxml2-2.7.8-9.fc17 (2012-13820)NessusFedora Local Security Checks
high
62206CentOS 5 / 6 : libxml2 (CESA-2012:1288)NessusCentOS Local Security Checks
medium
62197Scientific Linux Security Update : libxml2 on SL5.x, SL6.x i386/x86_64 (20120918)NessusScientific Linux Local Security Checks
medium
62195RHEL 5 / 6 : libxml2 (RHSA-2012:1288)NessusRed Hat Local Security Checks
medium
59894GLSA-201207-02 : libxml2: User-assisted execution of arbitrary codeNessusGentoo Local Security Checks
medium
59722SuSE 10 Security Update : libxml2 (ZYPP Patch Number 8156)NessusSuSE Local Security Checks
medium
59652Mandriva Linux Security Advisory : libxml2 (MDVSA-2012:098)NessusMandriva Local Security Checks
medium
59251Debian DSA-2479-1 : libxml2 - off-by-oneNessusDebian Local Security Checks
medium
59225Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : libxml2 vulnerability (USN-1447-1)NessusUbuntu Local Security Checks
medium
800898Google Chrome < 19.0.1084.46 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
6487Google Chrome < 19.0.1084.46 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
59117Google Chrome < 19.0.1084.46 Multiple VulnerabilitiesNessusWindows
critical
8013Apple iOS < 7.0 Multiple VulnerabilitiesNessus Network MonitorMobile Devices
critical