Libxml2 UTF-8 Parsing Denial of Service Vulnerability - Advisories

Libxml2 UTF-8 Parsing Denial of Service Vulnerability

Secunia Advisory:	SA28444
Release Date:	2008-01-11

Critical:	Moderately critical
Impact:	DoS
Where:	From remote
Solution Status:	Vendor Patch

Software:	Libxml2 2.6.x

CVE reference:	CVE-2007-6284 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: A vulnerability has been reported in Libxml2, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an unspecified error within the "xmlCurrentChar()" function. This can be exploited to trigger the execution of an infinite loop via specially crafted UTF-8 sequences. The vulnerability is reported in versions prior to 2.6.31. Solution: Update to version 2.6.31 or apply patch. http://veillard.com/libxml2.patch Provided and/or discovered by: The vendor credits Brad Fitzpatrick from Google. Original Advisory: http://mail.gnome.org/archives/xml/2008-January/msg00036.html Other References: https://bugzilla.redhat.com/show_bug.cgi?id=425927



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

3 Related Secunia Security Advisories

1. Libxml2 Recursion Limit Denial of Service Vulnerability

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	dotProject SQL Injection and Cross-Site Scripting

2.	HP TCP/IP Services for OpenVMS Finger Format String Vulnerability

3.	Sun Solaris Kernel Covert Channel Security Bypass

4.	Novell eDirectory Multiple Vulnerabilities

5.	Slackware update for amarok

6.	PluggedOut Blog "index.php" SQL Injection Vulnerabilities

7.	Adium MSN SLP Message Integer Overflow Vulnerabilities

8.	Caudium "configvar" Insecure Temporary Files

9.	Blogn Cross-Site Scripting and Cross-Site Request Forgery

10.	Acoustica Mixcraft ".mx4" File Processing Buffer Overflow