CVE-2011-1944
CVE-2011-1944
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.
EPSS 13.4% · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- http://www.securityfocus.com/bid/48056
- http://secunia.com/advisories/44711
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:131
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
- http://lists.opensuse.org/opensuse-updates/2011-07/msg00035.html
- http://git.gnome.org/browse/libxml2/commit/?id=d7958b21e7f8c447a26bb2436f08402b2c308be4
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
- http://support.apple.com/kb/HT5503
- https://bugzilla.redhat.com/show_bug.cgi?id=709747
- http://rhn.redhat.com/errata/RHSA-2013-0217.html
- http://www.redhat.com/support/errata/RHSA-2011-1749.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.debian.org/security/2011/dsa-2255
- http://www.osvdb.org/73248
- http://scarybeastsecurity.blogspot.com/2011/05/libxml-vulnerability-and-interesting.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062238.html
- http://www.openwall.com/lists/oss-security/2011/05/31/8
- http://support.apple.com/kb/HT5281
- http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
- http://ubuntu.com/usn/usn-1153-1
- https://nvd.nist.gov/vuln/detail/CVE-2011-1944