CVE-2015-1819

MEDIUM
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

References

http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html

http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html

http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html

http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172710.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172943.html

http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html

http://rhn.redhat.com/errata/RHSA-2015-1419.html

http://rhn.redhat.com/errata/RHSA-2015-2550.html

http://www.debian.org/security/2015/dsa-3430

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.securityfocus.com/bid/75570

http://www.securitytracker.com/id/1034243

http://www.ubuntu.com/usn/USN-2812-1

http://xmlsoft.org/news.html

https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9

https://security.gentoo.org/glsa/201507-08

https://security.gentoo.org/glsa/201701-37

https://support.apple.com/HT206166

https://support.apple.com/HT206167

https://support.apple.com/HT206168

https://support.apple.com/HT206169

Details

Source: MITRE

Published: 2015-08-14

Updated: 2019-12-27

Type: CWE-399

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Tenable Plugins

View all (30 total)

IDNameProductFamilySeverity
125603Amazon Linux 2 : libxml2 (ALAS-2019-1220)NessusAmazon Linux Local Security Checks
critical
96541GLSA-201701-37 : libxml2: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
9336Apple TV < 9.2 Multiple VulnerabilitiesNessus Network MonitorInternet Services
critical
9327Mac OS X 10.11.x < 10.11.4 Multiple VulnerabilitiesNessus Network MonitorOperating System Detection
critical
9331Apple iOS < 9.3 Multiple VulnerabilitiesNessus Network MonitorMobile Devices
high
90309Apple TV < 9.2 Multiple VulnerabilitiesNessusMisc.
critical
90118Apple iOS < 9.3 Multiple VulnerabilitiesNessusMobile Devices
critical
90097Mac OS X 10.9.5 / 10.10.5 Multiple Vulnerabilities (Security Update 2016-002)NessusMacOS X Local Security Checks
critical
90096Mac OS X 10.11.x < 10.11.4 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
critical
89394Fedora 23 : libxml2-2.9.3-1.fc23 (2015-c24af963a2)NessusFedora Local Security Checks
medium
89130Fedora 22 : libxml2-2.9.3-1.fc22 (2015-037f844d3e)NessusFedora Local Security Checks
medium
88122openSUSE Security Update : libxml2 (openSUSE-2016-32)NessusSuSE Local Security Checks
high
87865SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:0049-1)NessusSuSE Local Security Checks
high
87862SUSE SLED11 / SLES11 Security Update : libxml2 (SUSE-SU-2016:0030-1)NessusSuSE Local Security Checks
high
87631openSUSE Security Update : libxml2 (openSUSE-2015-959)NessusSuSE Local Security Checks
high
87608Debian DSA-3430-1 : libxml2 - security updateNessusDebian Local Security Checks
critical
87581Scientific Linux Security Update : libxml2 on SL7.x x86_64 (20151207)NessusScientific Linux Local Security Checks
high
87354Amazon Linux AMI : libxml2 (ALAS-2015-628)NessusAmazon Linux Local Security Checks
high
87234RHEL 7 : libxml2 (RHSA-2015:2550)NessusRed Hat Local Security Checks
critical
87231Oracle Linux 7 : libxml2 (ELSA-2015-2550)NessusOracle Linux Local Security Checks
critical
87224CentOS 7 : libxml2 (CESA-2015:2550)NessusCentOS Local Security Checks
critical
86897Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : libxml2 vulnerabilities (USN-2812-1)NessusUbuntu Local Security Checks
medium
85200Scientific Linux Security Update : libxml2 on SL6.x i386/x86_64 (20150722)NessusScientific Linux Local Security Checks
medium
85138OracleVM 3.3 : libxml2 (OVMSA-2015-0097)NessusOracleVM Local Security Checks
medium
85106Oracle Linux 6 : libxml2 (ELSA-2015-1419)NessusOracle Linux Local Security Checks
medium
85019CentOS 6 : libxml2 (CESA-2015:1419)NessusCentOS Local Security Checks
medium
84945RHEL 6 : libxml2 (RHSA-2015:1419)NessusRed Hat Local Security Checks
medium
84607GLSA-201507-08 : libxml2: Denial of ServiceNessusGentoo Local Security Checks
medium
84508Debian DLA-266-1 : libxml2 security updateNessusDebian Local Security Checks
medium
84496FreeBSD : libxml2 -- Enforce the reader to run in constant memory (9c7177ff-1fe1-11e5-9a01-bcaec565249c)NessusFreeBSD Local Security Checks
medium