ID CVE-2015-8035
Summary The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
References
Vulnerable Configurations
  • Debian Linux 7.0
    cpe:2.3:o:debian:debian_linux:7.0
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • XMLSoft Libxml2 2.9.1
    cpe:2.3:a:xmlsoft:libxml2:2.9.1
  • Apple iPhone OS 9.2.1
    cpe:2.3:o:apple:iphone_os:9.2.1
  • Apple Mac OS X 10.11.3
    cpe:2.3:o:apple:mac_os_x:10.11.3
  • Apple tvOS 9.1
    cpe:2.3:o:apple:tvos:9.1
  • Apple WatchOS 2.1
    cpe:2.3:o:apple:watchos:2.1
  • Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
CVSS
Base: 2.6 (as of 24-06-2016 - 18:48)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2812-1.NASL
    description Florian Weimer discovered that libxml2 incorrectly handled certain XML data. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause resource consumption, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-1819) Michal Zalewski discovered that libxml2 incorrectly handled certain XML data. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-7941) Kostya Serebryany discovered that libxml2 incorrectly handled certain XML data. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-7942) Gustavo Grieco discovered that libxml2 incorrectly handled certain XML data. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-8035). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 86897
    published 2015-11-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86897
    title Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : libxml2 vulnerabilities (USN-2812-1)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_11_4.NASL
    description The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.4. It is, therefore, affected by multiple vulnerabilities in the following components : - apache_mod_php - AppleRAID - AppleUSBNetworking - Bluetooth - Carbon - dyld - FontParser - HTTPProtocol - Intel Graphics Driver - IOFireWireFamily - IOGraphics - IOHIDFamily - IOUSBFamily - Kernel - libxml2 - Messages - NVIDIA Graphics Drivers - OpenSSH - OpenSSL - Python - QuickTime - Reminders - Ruby - Security - Tcl - TrueTypeScaler - Wi-Fi Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 90096
    published 2016-03-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90096
    title Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-959.NASL
    description - update to 2.9.3 - full changelog: http://www.xmlsoft.org/news.html - fixed CVEs: CVE-2015-8242, CVE-2015-7500, CVE-2015-7499, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-8035, CVE-2015-7942, CVE-2015-1819, CVE-2015-7941, CVE-2014-3660, CVE-2014-0191, CVE-2015-8241, CVE-2015-8317 - fixed bugs: [bsc#928193], [bsc#951734], [bsc#951735], [bsc#954429], [bsc#956018], [bsc#956021], [bsc#956260], [bsc#957105], [bsc#957106], [bsc#957107], [bsc#957109], [bsc#957110]
    last seen 2019-02-21
    modified 2016-05-16
    plugin id 87631
    published 2015-12-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=87631
    title openSUSE Security Update : libxml2 (openSUSE-2015-959)
  • NASL family Misc.
    NASL id LCE_4_8_0.NASL
    description The version of Tenable Log Correlation Engine (LCE) installed on the remote host is a version prior to 4.8.0. It is, therefore, affected by a denial of service vulnerability in the bundled version of Libxml2 due to an infinite loop condition in the xz_decomp() function. An unauthenticated, remote attacker can exploit this by convincing a user to input specially crafted XML content, to exhaust available system resources, resulting in a denial of service condition.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 90706
    published 2016-04-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90706
    title Tenable Log Correlation Engine (LCE) < 4.8.0 Libxml2 DoS
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2016-A9EE80B01D.NASL
    description Update to 2.9.3 which fixes various CVE's Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-05-16
    plugin id 89591
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89591
    title Fedora 22 : mingw-libxml2-2.9.3-1.fc22 (2016-a9ee80b01d)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2016-189A7BF68C.NASL
    description Update to 2.9.3 which fixes various CVE's Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-05-16
    plugin id 89484
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89484
    title Fedora 23 : mingw-libxml2-2.9.3-1.fc23 (2016-189a7bf68c)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3430.NASL
    description Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or crash the application.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 87608
    published 2015-12-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=87608
    title Debian DSA-3430-1 : libxml2 - security update
  • NASL family Web Servers
    NASL id HPSMH_7_5_5.NASL
    description According to its banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is affected by the following vulnerabilities : - A denial of service vulnerability exists in the Apache HTTP Server due to the lack of the mod_reqtimeout module. An unauthenticated, remote attacker can exploit this, via a saturation of partial HTTP requests, to cause a daemon outage. (CVE-2007-6750) - A cross-site scripting (XSS) vulnerability exists in jQuery when using location.hash to select elements. An unauthenticated, remote attacker can exploit this, via a specially crafted tag, to inject arbitrary script code or HTML into the user's browser session. (CVE-2011-4969) - A NULL pointer dereference flaw exists in file rsa_ameth.c due to improper handling of ASN.1 signatures that are missing the PSS parameter. A remote attacker can exploit this to cause the signature verification routine to crash, resulting in a denial of service condition. (CVE-2015-3194) - A flaw exists in the ASN1_TFLG_COMBINE implementation in file tasn_dec.c related to handling malformed X509_ATTRIBUTE structures. A remote attacker can exploit this to cause a memory leak by triggering a decoding failure in a PKCS#7 or CMS application, resulting in a denial of service. (CVE-2015-3195) - An out-of-bounds read error exists in cURL and libcurl within the smb_request_state() function due to improper bounds checking. An unauthenticated, remote attacker can exploit this, using a malicious SMB server and crafted length and offset values, to disclose sensitive memory information or to cause a denial of service condition. (CVE-2015-3237) - A flaw exists in libxslt in the xsltStylePreCompute() function within file preproc.c due to a failure to check if the parent node is an element. An unauthenticated, remote attacker can exploit this, via a specially crafted XML file, to cause a denial of service condition. (CVE-2015-7995) - An infinite loop condition exists in the xz_decomp() function within file xzlib.c when handling xz compressed XML content due to a failure to detect compression errors. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to cause a denial of service condition. (CVE-2015-8035) - A double-free error exists due to improper validation of user-supplied input when parsing malformed DSA private keys. A remote attacker can exploit this to corrupt memory, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-0705) - An out-of-bounds read error exists in the fmtstr() function within file crypto/bio/b_print.c when printing very long strings due to a failure to properly calculate string lengths. An unauthenticated, remote attacker can exploit this, via a long string, to cause a denial of service condition, as demonstrated by a large amount of ASN.1 data. (CVE-2016-0799) - An unspecified flaw exists that allows a local attacker to impact the confidentiality and integrity of the system. No other details are available. (CVE-2016-2015) - A flaw exists in the doapr_outch() function within file crypto/bio/b_print.c due to a failure to verify that a certain memory allocation succeeds. An unauthenticated, remote attacker can exploit this, via a long string, to cause a denial of service condition, as demonstrated by a large amount of ASN.1 data. (CVE-2016-2842)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 91222
    published 2016-05-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=91222
    title HP System Management Homepage Multiple Vulnerabilities (HPSBMU03593)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_E5423CAF8FB811E5918CBCAEC565249C.NASL
    description reports : CVE-2015-5312 Another entity expansion issue (David Drysdale). CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale). CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard). CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser (Daniel Veillard). CVE-2015-7499 (2) Detect incoherency on GROW (Daniel Veillard). CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard). CVE-2015-7941 (1) Stop parsing on entities boundaries errors (Daniel Veillard). CVE-2015-7941 (2) Cleanup conditional section error handling (Daniel Veillard). CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard). CVE-2015-7942 (2) Fix an error in previous Conditional section patch (Daniel Veillard). CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard). CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport)
    last seen 2019-02-21
    modified 2018-11-23
    plugin id 87000
    published 2015-11-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=87000
    title FreeBSD : libxml2 -- multiple vulnerabilities (e5423caf-8fb8-11e5-918c-bcaec565249c)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2016-002.NASL
    description The remote host is running a version of Mac OS X that is 10.9.5 or 10.10.5 and is missing Security Update 2016-002. It is, therefore, affected by multiple vulnerabilities in the following components : - apache_mod_php - Kernel - libxml2 - OpenSSH - Python - Tcl Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 90097
    published 2016-03-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90097
    title Mac OS X 10.9.5 / 10.10.5 Multiple Vulnerabilities (Security Update 2016-002)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-0049-1.NASL
    description - security update: This update fixes the following security issues : - CVE-2015-1819 Enforce the reader to run in constant memory [bnc#928193] - CVE-2015-7941 Fix out of bound read with crafted xml input by stopping parsing on entities boundaries errors [bnc#951734] - CVE-2015-7942 Fix another variation of overflow in Conditional sections [bnc#951735] - CVE-2015-8241 Avoid extra processing of MarkupDecl when EOF [bnc#956018] - CVE-2015-8242 Buffer overead with HTML parser in push mode [bnc#956021] - CVE-2015-8317 Return if the encoding declaration is broken or encoding conversion failed [bnc#956260] - CVE-2015-5312 Fix another entity expansion issue [bnc#957105] - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey [bnc#957106] - CVE-2015-7498 Processes entities after encoding conversion failures [bnc#957107] - CVE-2015-7499 Add xmlHaltParser() to stop the parser / Detect incoherency on GROW [bnc#957109] - CVE-2015-8317 Multiple out-of-bound read could lead to denial of service [bnc#956260] - CVE-2015-8035 DoS when parsing specially crafted XML document if XZ support is enabled [bnc#954429] - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries [bnc#957110] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 87865
    published 2016-01-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=87865
    title SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:0049-1)
  • NASL family Misc.
    NASL id APPLETV_9_2.NASL
    description According to its banner, the remote Apple TV device is a version prior to 9.2. It is, therefore, affected by the following vulnerabilities : - An XML external entity (XXE) expansion flaw exists in libxml2 due to the XML parser accepting entities from untrusted sources. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service through resource exhaustion. (CVE-2015-1819) - An XML external entity (XXE) injection flaw exists in libxml2 in file parser.c due to the XML parser accepting entities from untrusted sources. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service or to disclose sensitive information. (CVE-2015-5312) - A heap buffer overflow condition exists in libxml2 in the xmlGROW() function within file parser.c while handling XML data. An unauthenticated, remote attacker can exploit this to disclose sensitive information. (CVE-2015-7499) - An out-of-bounds heap read error exists in libxml2 in the xmlParseMisc() function within file parser.c while handling entity boundaries. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2015-7500) - An out-of-bounds read error exists in libxml2 in the xmlParseConditionalSections() function within file parser.c due to a failure to properly skip intermediary entities when it stops parsing invalid input. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service. (CVE-2015-7942) - A flaw exists in libxml2 in the xz_decomp() function within file xzlib.c due to a failure to properly detect compression errors when handling compressed XML content. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause an infinite loop, resulting in a denial of service. (CVE-2015-8035) - A out-of-bounds read error exists in libxml2 in the xmlSAX2TextNode() function within file SAX2.c due to improper sanitization of input data. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service or to disclose sensitive information. (CVE-2015-8242) - A use-after-free error exists in Nghttp2 within file lib/nghttp2_session.c when handling idle streams. An unauthenticated, remote attacker can exploit this to deference already freed memory, allowing the execution of arbitrary code. (CVE-2015-8659) - An overflow condition exists in the Broadcom Wi-Fi driver due to improper validation of data while handling SSID or WPS_ID_DEVICE_NAME values. An unauthenticated, adjacent attacker can exploit this, via a crafted wireless control message packet, to cause a denial of service or to execute arbitrary code. (CVE-2016-0801) - An overflow condition exists in the Broadcom Wi-Fi driver due to improper validation of user-supplied input when handling the packet length of event messages. An unauthenticated, adjacent attacker can exploit this, via a crafted wireless control message packet, to cause a denial of service or to execute arbitrary code. (CVE-2016-0802) - A flaw exists in FontParser due to improper validation of user-supplied input when handling encoded fonts that contain invalid characters. An unauthenticated, remote attacker can exploit this, via a crafted PDF document, to corrupt memory, resulting in a denial of service or the execution arbitrary code. (CVE-2016-1740) - A flaw exists in IOHIDFamily due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted application, to gain access to kernel memory layout information. (CVE-2016-1748) - A use-after-free error exists in the kernel that allows an unauthenticated, remote attacker to execute arbitrary code via a crafted application. (CVE-2016-1750) - A flaw exists in the kernel due to a failure to properly restrict execution permissions. An unauthenticated, remote attacker can exploit this, via a crafted application, to bypass code-signing protection mechanisms. (CVE-2016-1751) - An unspecified flaw exists in the kernel that allows a local attacker to cause a denial of service via a crafted application. (CVE-2016-1752) - An integer overflow condition exists in the kernel due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted application, to gain elevated privileges. (CVE-2016-1753) - A memory corruption issue exists in the kernel due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to install a malicious application, to cause a denial of service or execute arbitrary code. CVE-2016-1754) - A use-after-free error exists in the AppleKeyStore user client when handling multiple threads, which is triggered when one thread closes the user client while another attempts to call an external method. An unauthenticated, remote attacker can exploit this, by convincing a user to install a malicious application, to execute arbitrary code with elevated privileges. (CVE-2016-1755) - A flaw exists in libxml2 due to improper validation of user-supplied input while handling XML content. An unauthenticated, remote attacker can exploit this, via a crafted XML document, to cause a denial of service or to execute arbitrary code. (CVE-2016-1762) - An out-of-bounds write error exists in TrueTypeScaler due to improper validation of user-supplied input while handling bdat tables in TTF fonts. An unauthenticated, remote attacker can exploit this, via a crafted TTF font, to cause a denial or service or to execute arbitrary code. (CVE-2016-1775) - A flaw exists in WebKit due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted website, to cause a denial of service or execute arbitrary code. (CVE-2016-1783) - An unspecified flaw exists in the History implementation of WebKit that allows an unauthenticated, remote attacker to cause a denial of service via a crafted website. (CVE-2016-1784) - A heap buffer overflow condition exists in Mozilla Network Security Services due to improper validation of user-supplied input while parsing ASN.1 structures. An unauthenticated, remote attacker can exploit this, via crafted ASN.1 data in an X.509 certificate, to cause a denial of service or execute arbitrary code. (CVE-2016-1950) Note that only 4th generation models are affected by these vulnerabilities, and this plugin only checks these models.
    last seen 2019-02-21
    modified 2018-12-14
    plugin id 90309
    published 2016-04-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=90309
    title Apple TV < 9.2 Multiple Vulnerabilities
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201701-37.NASL
    description The remote host is affected by the vulnerability described in GLSA-201701-37 (libxml2: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user or automated system to process a specially crafted XML document, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2017-01-17
    plugin id 96541
    published 2017-01-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96541
    title GLSA-201701-37 : libxml2: Multiple vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-32.NASL
    description - security update: This update fixes the following security issues : - CVE-2015-1819 Enforce the reader to run in constant memory [bnc#928193] - CVE-2015-7941 Fix out of bound read with crafted xml input by stopping parsing on entities boundaries errors [bnc#951734] - CVE-2015-7942 Fix another variation of overflow in Conditional sections [bnc#951735] - CVE-2015-8241 Avoid extra processing of MarkupDecl when EOF [bnc#956018] - CVE-2015-8242 Buffer overead with HTML parser in push mode [bnc#956021] - CVE-2015-8317 Return if the encoding declaration is broken or encoding conversion failed [bnc#956260] - CVE-2015-5312 Fix another entity expansion issue [bnc#957105] - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey [bnc#957106] - CVE-2015-7498 Processes entities after encoding conversion failures [bnc#957107] - CVE-2015-7499 Add xmlHaltParser() to stop the parser / Detect incoherency on GROW [bnc#957109] - CVE-2015-8317 Multiple out-of-bound read could lead to denial of service [bnc#956260] - CVE-2015-8035 DoS when parsing specially crafted XML document if XZ support is enabled [bnc#954429] - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries [bnc#957110] This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2019-02-21
    modified 2016-05-16
    plugin id 88122
    published 2016-01-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=88122
    title openSUSE Security Update : libxml2 (openSUSE-2016-32)
redhat via4
advisories
rhsa
id RHSA-2016:1089
refmap via4
apple
  • APPLE-SA-2016-03-21-1
  • APPLE-SA-2016-03-21-2
  • APPLE-SA-2016-03-21-3
  • APPLE-SA-2016-03-21-5
bid 77390
confirm
debian DSA-3430
fedora
  • FEDORA-2016-189a7bf68c
  • FEDORA-2016-a9ee80b01d
gentoo GLSA-201701-37
mlist
  • [oss-security] 20151102 CVE request: DoS in libxml2 if xz is enabled
  • [oss-security] 20151102 Re: CVE request: DoS in libxml2 if xz is enabled
  • [oss-security] 20151103 Re: CVE request: DoS in libxml2 if xz is enabled
sectrack 1034243
suse
  • openSUSE-SU-2015:2372
  • openSUSE-SU-2016:0106
ubuntu USN-2812-1
Last major update 07-12-2016 - 13:26
Published 18-11-2015 - 11:59
Last modified 08-03-2019 - 11:06
Back to Top