CVE-2015-7497

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors.

References

http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html

http://marc.info/?l=bugtraq&m=145382616617563&w=2

http://rhn.redhat.com/errata/RHSA-2015-2549.html

http://rhn.redhat.com/errata/RHSA-2015-2550.html

http://rhn.redhat.com/errata/RHSA-2016-1089.html

http://www.debian.org/security/2015/dsa-3430

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.securityfocus.com/bid/79508

http://www.securitytracker.com/id/1034243

http://www.ubuntu.com/usn/USN-2834-1

http://xmlsoft.org/news.html

https://bugzilla.redhat.com/show_bug.cgi?id=1281862

https://git.gnome.org/browse/libxml2/commit/?id=6360a31a84efe69d155ed96306b9a931a40beab9

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172

https://security.gentoo.org/glsa/201701-37

Details

Source: MITRE

Published: 2015-12-15

Updated: 2017-09-14

Type: CWE-119

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* versions up to 2.9.2 (inclusive)

Configuration 4

OR

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Configuration 5

OR

cpe:2.3:a:hp:icewall_federation_agent:3.0:*:*:*:*:*:*:*

cpe:2.3:a:hp:icewall_file_manager:3.0:*:*:*:*:*:*:*

Tenable Plugins

View all (21 total)

IDNameProductFamilySeverity
125603Amazon Linux 2 : libxml2 (ALAS-2019-1220)NessusAmazon Linux Local Security Checks
critical
96541GLSA-201701-37 : libxml2: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
88742F5 Networks BIG-IP : Multiple libXML2 vulnerabilities (K61570943)NessusF5 Networks Local Security Checks
high
88122openSUSE Security Update : libxml2 (openSUSE-2016-32)NessusSuSE Local Security Checks
high
87865SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:0049-1)NessusSuSE Local Security Checks
high
87862SUSE SLED11 / SLES11 Security Update : libxml2 (SUSE-SU-2016:0030-1)NessusSuSE Local Security Checks
high
87631openSUSE Security Update : libxml2 (openSUSE-2015-959)NessusSuSE Local Security Checks
high
87608Debian DSA-3430-1 : libxml2 - security updateNessusDebian Local Security Checks
critical
87605Debian DLA-373-1 : libxml2 security updateNessusDebian Local Security Checks
high
87581Scientific Linux Security Update : libxml2 on SL7.x x86_64 (20151207)NessusScientific Linux Local Security Checks
high
87369Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : libxml2 vulnerabilities (USN-2834-1)NessusUbuntu Local Security Checks
high
87354Amazon Linux AMI : libxml2 (ALAS-2015-628)NessusAmazon Linux Local Security Checks
high
87235Scientific Linux Security Update : libxml2 on SL6.x i386/x86_64 (20151207)NessusScientific Linux Local Security Checks
high
87234RHEL 7 : libxml2 (RHSA-2015:2550)NessusRed Hat Local Security Checks
critical
87233RHEL 6 : libxml2 (RHSA-2015:2549)NessusRed Hat Local Security Checks
high
87232OracleVM 3.3 : libxml2 (OVMSA-2015-0152)NessusOracleVM Local Security Checks
high
87231Oracle Linux 7 : libxml2 (ELSA-2015-2550)NessusOracle Linux Local Security Checks
critical
87230Oracle Linux 6 : libxml2 (ELSA-2015-2549)NessusOracle Linux Local Security Checks
high
87224CentOS 7 : libxml2 (CESA-2015:2550)NessusCentOS Local Security Checks
critical
87223CentOS 6 : libxml2 (CESA-2015:2549)NessusCentOS Local Security Checks
high
87000FreeBSD : libxml2 -- multiple vulnerabilities (e5423caf-8fb8-11e5-918c-bcaec565249c)NessusFreeBSD Local Security Checks
high