Skip to content
OpenAdvisories
Unscored USN-2834-1 8 CVEs

libxml2 vulnerabilities

Published Dec 14, 2015 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Kostya Serebryany discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could possibly cause
libxml2 to crash, resulting in a denial of service. (CVE-2015-5312,
CVE-2015-7497, CVE-2015-7498, CVE-2015-7499,CVE-2015-7500)

Hugh Davenport discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could possibly cause
libxml2 to crash, resulting in a denial of service. (CVE-2015-8241,
CVE-2015-8242)

Hanno Boeck discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could possibly cause
libxml2 to crash, resulting in a denial of service. This issue only applied
to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-8317)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS libxml2 2.9.1+dfsg1-3ubuntu4.6

Vulnerabilities 8

  • High —
    CVE-2015-5312

    Nokogiri subject to DoS via libxml2 vulnerability

    The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability tha…

    libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  • Unscored —
    CVE-2015-7497

    Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-depe…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-7498

    Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent…

    libxml2 libxml2 Debian Ubuntu
  • Medium —
    CVE-2015-7499

    Heap-based buffer overflow in nokogiri

    Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

    libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  • Unscored —
    CVE-2015-7500

    The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of s…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-8241

    The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers t…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-8242

    The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2015-8317

    The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive…

    libxml2 libxml2 Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-5312
  • report
    https://ubuntu.com/security/CVE-2015-7497
  • report
    https://ubuntu.com/security/CVE-2015-7498
  • report
    https://ubuntu.com/security/CVE-2015-7499
  • report
    https://ubuntu.com/security/CVE-2015-7500
  • report
    https://ubuntu.com/security/CVE-2015-8241
  • report
    https://ubuntu.com/security/CVE-2015-8242
  • report
    https://ubuntu.com/security/CVE-2015-8317