// For flags

CVE-2008-4225

libxml2: integer overflow leading to infinite loop in xmlBufferResize

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.

Desbordamiento de entero en la función xmlBufferResize de libxml2 v2.7.2; permite a atacantes dependientes del contexto provocar una denegación de servicio (bucle infinito) a través de un documento XML largo.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-09-24 CVE Reserved
  • 2008-11-25 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-189: Numeric Errors
  • CWE-190: Integer Overflow or Wraparound
CAPEC
References (52)
URL Tag Source
http://secunia.com/advisories/32974 Third Party Advisory
http://secunia.com/advisories/33417 Third Party Advisory
http://secunia.com/advisories/33746 Third Party Advisory
http://secunia.com/advisories/33792 Third Party Advisory
http://secunia.com/advisories/34247 Third Party Advisory
http://secunia.com/advisories/35379 Third Party Advisory
http://secunia.com/advisories/36173 Third Party Advisory
http://secunia.com/advisories/36235 Third Party Advisory
http://securitytracker.com/id?1021239 Vdb Entry
http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1 X_refsource_confirm
http://sunsolve.sun.com/search/document.do?assetkey=1-21-141243-01-1 X_refsource_confirm
http://support.apple.com/kb/HT3613 X_refsource_confirm
http://support.apple.com/kb/HT3639 X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2009-002.htm X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2009-067.htm X_refsource_confirm
http://wiki.rpath.com/Advisories:rPSA-2008-0325 X_refsource_confirm
http://www.osvdb.org/49992 Vdb Entry
http://www.vmware.com/security/advisories/VMSA-2009-0001.html X_refsource_confirm
http://www.vupen.com/english/advisories/2008/3176 Vdb Entry
http://www.vupen.com/english/advisories/2009/0034 Vdb Entry
http://www.vupen.com/english/advisories/2009/0301 Vdb Entry
http://www.vupen.com/english/advisories/2009/0323 Vdb Entry
http://www.vupen.com/english/advisories/2009/1522 Vdb Entry
http://www.vupen.com/english/advisories/2009/1621 Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10025 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6234 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6415 Signature
URL Date SRC
URL Date SRC
http://secunia.com/advisories/32764 2017-09-29
http://www.debian.org/security/2008/dsa-1666 2017-09-29
http://www.securityfocus.com/bid/32331 2017-09-29
https://admin.fedoraproject.org/updates/libxml2-2.7.2-2.fc10 2017-09-29
https://admin.fedoraproject.org/updates/libxml2-2.7.2-2.fc9 2017-09-29
URL Date SRC
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html 2017-09-29
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html 2017-09-29
http://secunia.com/advisories/32762 2017-09-29
http://secunia.com/advisories/32766 2017-09-29
http://secunia.com/advisories/32773 2017-09-29
http://secunia.com/advisories/32802 2017-09-29
http://secunia.com/advisories/32807 2017-09-29
http://secunia.com/advisories/32811 2017-09-29
http://security.gentoo.org/glsa/glsa-200812-06.xml 2017-09-29
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473974 2017-09-29
http://sunsolve.sun.com/search/document.do?assetkey=1-26-251406-1 2017-09-29
http://sunsolve.sun.com/search/document.do?assetkey=1-66-261688-1 2017-09-29
http://sunsolve.sun.com/search/document.do?assetkey=1-66-265329-1 2017-09-29
http://www.mandriva.com/security/advisories?name=MDVSA-2008:231 2017-09-29
http://www.redhat.com/support/errata/RHSA-2008-0988.html 2017-09-29
http://www.ubuntu.com/usn/usn-673-1 2017-09-29
https://bugzilla.redhat.com/show_bug.cgi?id=470480 2008-11-17
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00472.html 2017-09-29
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00513.html 2017-09-29
https://access.redhat.com/security/cve/CVE-2008-4225 2008-11-17
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Xmlsoft
Search vendor "Xmlsoft"
 Libxml
Search vendor "Xmlsoft" for product "Libxml"
 2.7.2
Search vendor "Xmlsoft" for product "Libxml" and version "2.7.2"
-
Affected