Description
Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml2 | 2.6.32.dfsg-4 | — |
| Debian 13 | libxml2 | 2.6.32.dfsg-4 | — |
| Debian 12 | libxml2 | 2.6.32.dfsg-4 | — |
| Debian 4.0 | libxml2 | 2.6.27.dfsg-5 | DSA-1654-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | libxml2 +2 | 2.6.26-2.1.2.6 | RHSA-2008:0884 |
| RHEL 4 | libxml2 +2 | 2.6.16-12.5 | RHSA-2008:0884 |
| RHEL 3 | libxml2 +2 | 2.5.10-13 | RHSA-2008:0884 |
| RHEL 2 | libxml2 +2 | 2.4.19-11.ent | RHSA-2008:0886 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Apple Safari - RSS 'feed://' Buffer Overflow via libxml2 (PoC) EDB-8798 · dos · May 26, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2008:0884 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0886 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1654-1 libxml2 - execution of arbitrary code Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-815-1 vendor-advisory
- USN-644-1 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-400.htm
- http://support.apple.com/kb/HT3639
- 31860 third-party-advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-141243-01-1
- 32280 third-party-advisory
- 31855 third-party-advisory
- ADV-2009-1621 vdb-entry
- libxml2-entitynames-bo(45085) vdb-entry
- http://support.apple.com/kb/HT3549
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1
- 32807 third-party-advisory
- APPLE-SA-2009-06-08-1 vendor-advisory
- 31982 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=461015
- 31868 third-party-advisory
- DSA-1654 vendor-advisory
- http://xmlsoft.org/news.html
- oval:org.mitre.oval:def:6103 vdb-entry signature
- ADV-2009-1298 vdb-entry
- 35074 third-party-advisory
- 8798 exploit
- 36173 third-party-advisory
- RHSA-2008:0884 vendor-advisory
- ADV-2009-1522 vdb-entry
- 1020855 vdb-entry
- 32265 third-party-advisory
- GLSA-200812-06 vendor-advisory
- APPLE-SA-2009-06-17-1 vendor-advisory
- 33715 third-party-advisory
- SUSE-SR:2008:018 vendor-advisory
- 35056 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0325
- 247346 vendor-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- 31126 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2009-025.htm
- 35379 third-party-advisory
- 33722 third-party-advisory
- MDVSA-2008:192 vendor-advisory
- 32974 third-party-advisory
- oval:org.mitre.oval:def:11760 vdb-entry signature
- 36235 third-party-advisory
- TA09-133A third-party-advisory
- 265329 vendor-advisory
- ADV-2009-1297 vdb-entry
- http://support.apple.com/kb/HT3550
- 261688 vendor-advisory
- 31558 third-party-advisory
- http://support.apple.com/kb/HT3613
- ADV-2008-2822 vdb-entry
- RHSA-2008:0886 vendor-advisory