Total vulnerabilities in the database
The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.
| Software | From | Fixed in |
|---|---|---|
| canonical / ubuntu_linux | 12.04 | 12.04.x |
| canonical / ubuntu_linux | 16.04 | 16.04.x |
| canonical / ubuntu_linux | 15.10 | 15.10.x |
| canonical / ubuntu_linux | 14.04 | 14.04.x |
| xmlsoft / libxml2 | 2.9.3 | 2.9.3.x |
| debian / debian_linux | 8.0 | 8.0.x |
| hp / icewall_file_manager | 3.0 | 3.0.x |
| hp / icewall_federation_agent | 3.0 | 3.0.x |
| opensuse / leap | 42.1 | 42.1.x |