Skip to content
OpenAdvisories
Unscored RHSA-2015:2549 11 CVEs

Red Hat Security Advisory: libxml2 security update

Published Sep 15, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client libxml2 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::client libxml2-debuginfo 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::client libxml2-devel 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::client libxml2-python 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::client libxml2-static 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2-debuginfo 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2-devel 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2-python 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2-static 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2-debuginfo 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2-devel 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2-python 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2-static 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2-debuginfo 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2-devel 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2-python 0:2.7.6-20.el6_7.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2-static 0:2.7.6-20.el6_7.1

Vulnerabilities 11

  • High —
    CVE-2015-5312

    Nokogiri subject to DoS via libxml2 vulnerability

    The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability tha…

    libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  • Unscored —
    CVE-2015-7497

    Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-depe…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-7498

    Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent…

    libxml2 libxml2 Debian Ubuntu
  • Medium —
    CVE-2015-7499

    Heap-based buffer overflow in nokogiri

    Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

    libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  • Unscored —
    CVE-2015-7500

    The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of s…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-7941

    libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial …

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-7942

    The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it st…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-8241

    The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers t…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-8242

    The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-8317

    The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-8710 Public exploit

    The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a deni…

    libxml2 libxml2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1213957
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1274222
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1276297
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1276693
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1281862
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1281879
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1281925
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1281930
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1281936
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1281943
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1281950
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1281955
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2549.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-5312
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5312
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5312
  • report
    https://access.redhat.com/security/cve/CVE-2015-7497
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7497
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7497
  • report
    https://access.redhat.com/security/cve/CVE-2015-7498
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7498
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7498
  • report
    https://access.redhat.com/security/cve/CVE-2015-7499
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7499
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7499
  • report
    https://access.redhat.com/security/cve/CVE-2015-7500
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7500
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7500
  • report
    https://access.redhat.com/security/cve/CVE-2015-7941
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7941
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7941
  • report
    https://access.redhat.com/security/cve/CVE-2015-7942
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-7942
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-7942
  • report
    https://access.redhat.com/security/cve/CVE-2015-8241
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-8241
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-8241
  • report
    https://access.redhat.com/security/cve/CVE-2015-8242