CVE-2010-4008
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause…
Does this matter?
Lower severity and a low EPSS score (2.70%). Track it; it rarely justifies an emergency change on its own.
Description
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
- EPSS
- 2.70% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- google/chrome · apple/itunes · apple/safari · apple/iphone os · apple/mac os x · xmlsoft/libxml2 · debian/debian linux · canonical/ubuntu linux · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux server eus · redhat/enterprise linux workstation · opensuse/opensuse · suse/suse linux enterprise server · apache/openoffice
- Source
- product-security@apple.com
References
- http://blog.bkis.com/en/libxml2-vulnerability-in-google-chrome-and-apple-safari/Broken Link
- http://code.google.com/p/chromium/issues/detail?id=58731Exploit, Issue Tracking, Patch, Vendor Advisory
- http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.htmlMailing List, Third Party Advisory
- http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.htmlMailing List, Third Party Advisory
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.htmlMailing List, Third Party Advisory
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.htmlMailing List, Third Party Advisory
- http://mail.gnome.org/archives/xml/2010-November/msg00015.htmlMailing List, Release Notes, Vendor Advisory
- http://marc.info/?l=bugtraq&m=130331363227777&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=139447903326211&w=2Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0217.htmlThird Party Advisory
- http://secunia.com/advisories/40775Third Party Advisory
- http://secunia.com/advisories/42109Third Party Advisory, Vendor Advisory
- http://secunia.com/advisories/42175Third Party Advisory, Vendor Advisory
- http://secunia.com/advisories/42314Third Party Advisory
- http://secunia.com/advisories/42429Third Party Advisory
- http://support.apple.com/kb/HT4456Third Party Advisory
- http://support.apple.com/kb/HT4554Third Party Advisory
- http://support.apple.com/kb/HT4566Third Party Advisory
- http://support.apple.com/kb/HT4581Third Party Advisory
- http://www.debian.org/security/2010/dsa-2128Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:243Third Party Advisory
- http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1749.htmlThird Party Advisory
- http://www.securityfocus.com/bid/44779Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1016-1Third Party Advisory
- http://www.vupen.com/english/advisories/2010/3046Permissions Required
- http://www.vupen.com/english/advisories/2010/3076Permissions Required
- http://www.vupen.com/english/advisories/2010/3100Permissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.