Description
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml2 | 2.7.8.dfsg-1 | — |
| Debian 13 | libxml2 | 2.7.8.dfsg-1 | — |
| Debian 12 | libxml2 | 2.7.8.dfsg-1 | — |
| Debian 5.0 | libxml2 | 2.6.32.dfsg-5+lenny2 | DSA-2128-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libxml2 +3 | 2.7.6-4.el6 | RHSA-2011:1749 |
| RHEL 6 | mingw32-libxml2 +1 | 2.7.6-6.el6_3 | RHSA-2013:0217 |
| RHEL 5 | libxml2 +2 | 2.6.26-2.1.12.el5_7.2 | RHSA-2012:0017 |
Advisories 5
- RHSA-2013:0217 Red Hat Security Advisory: mingw32-libxml2 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0017 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1749 Red Hat Security Advisory: libxml2 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2128-1 libxml2 - potential code execution Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
References
- 40775 third-party-advisory
- 42175 third-party-advisory
- [xml] 20101104 Release of libxml2-2.7.8 mailing-list
- http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html
- HPSBMA02662 vendor-advisory
- 44779 vdb-entry
- ADV-2011-0230 vdb-entry
- ADV-2010-3046 vdb-entry
- RHSA-2013:0217 vendor-advisory
- USN-1016-1 vendor-advisory
- http://blog.bkis.com/en/libxml2-vulnerability-in-google-chrome-and-apple-safari/
- 42109 third-party-advisory
- http://support.apple.com/kb/HT4566
- SUSE-SR:2010:023 vendor-advisory
- RHSA-2011:1749 vendor-advisory
- APPLE-SA-2011-03-21-1 vendor-advisory
- APPLE-SA-2011-03-02-1 vendor-advisory
- http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.html
- ADV-2010-3100 vdb-entry
- 42314 third-party-advisory
- http://support.apple.com/kb/HT4554
- DSA-2128 vendor-advisory
- MDVSA-2010:243 vendor-advisory
- APPLE-SA-2011-03-09-2 vendor-advisory
- ADV-2010-3076 vdb-entry
- http://support.apple.com/kb/HT4456
- oval:org.mitre.oval:def:12148 vdb-entry signature
- http://code.google.com/p/chromium/issues/detail?id=58731
- HPSBGN02970 vendor-advisory
- 42429 third-party-advisory
- APPLE-SA-2010-11-22-1 vendor-advisory
- http://support.apple.com/kb/HT4581