Vulnerability Name:

CVE-2008-3281 (CCN-44598)

Assigned:2008-08-20
Published:2008-08-20
Updated:2018-10-11
Summary:libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-399
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2008-3281

Source: APPLE
Type: UNKNOWN
APPLE-SA-2009-06-08-1

Source: APPLE
Type: UNKNOWN
APPLE-SA-2009-06-17-1

Source: SUSE
Type: UNKNOWN
SUSE-SR:2008:018

Source: CCN
Type: VMSA-2008-0017
Updated ESX packages for libxml2, ucd-snmp, libtiff

Source: MLIST
Type: UNKNOWN
[Security-announce] 20081030 VMSA-2008-0017 Updated ESX packages for libxml2, ucd-snmp, libtiff

Source: CCN
Type: xml Mailing List, Wed, 20 Aug 2008 19:00:51 +0200
Security fix for libxml2

Source: MLIST
Type: Exploit
[xml] 20080820 Security fix for libxml2

Source: CCN
Type: RHSA-2008-0836
Moderate: libxml2 security update

Source: CCN
Type: SA31558
Libxml2 Recursion Limit Denial of Service Vulnerability

Source: SECUNIA
Type: UNKNOWN
31558

Source: SECUNIA
Type: UNKNOWN
31566

Source: SECUNIA
Type: UNKNOWN
31590

Source: SECUNIA
Type: UNKNOWN
31728

Source: SECUNIA
Type: UNKNOWN
31748

Source: SECUNIA
Type: UNKNOWN
31855

Source: SECUNIA
Type: UNKNOWN
31982

Source: CCN
Type: SA32488
VMware ESX Server update for libxml2

Source: SECUNIA
Type: UNKNOWN
32488

Source: SECUNIA
Type: UNKNOWN
32807

Source: SECUNIA
Type: UNKNOWN
32974

Source: CCN
Type: SA35379
Apple Safari Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
35379

Source: CCN
Type: SA37555
Sun Management Center XML Library Multiple Vulnerabilities

Source: GENTOO
Type: UNKNOWN
GLSA-200812-06

Source: CCN
Type: SECTRACK ID: 1020728
Libxml2 Recursive Entity Evaluation Bug Lets Remote Users Deny Service

Source: CCN
Type: Sun Alert ID: 266428
Multiple Security Vulnerabilities in the XML Library (see libxml2(3)) Bundled With Sun Management Center (SunMC) May Result in Arbitrary Code Execution or a Denial of Service (DoS)

Source: CCN
Type: Apple Web site
About the security content of Safari 4.0

Source: CONFIRM
Type: UNKNOWN
http://support.apple.com/kb/HT3613

Source: CONFIRM
Type: UNKNOWN
http://support.apple.com/kb/HT3639

Source: CCN
Type: ASA-2008-402
libxml2 security update (RHSA-2008-0836)

Source: CONFIRM
Type: UNKNOWN
http://svn.gnome.org/viewvc/libxml2?view=revision&revision=3772

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/Advisories:rPSA-2008-0325

Source: DEBIAN
Type: UNKNOWN
DSA-1631

Source: DEBIAN
Type: DSA-1631
libxml2 -- denial of service

Source: CCN
Type: GLSA-200812-06
libxml2: Multiple vulnerabilities

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2008:180

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2008:192

Source: BUGTRAQ
Type: UNKNOWN
20081031 VMSA-2008-0017 Updated ESX packages for libxml2, ucd-snmp, libtiff

Source: BID
Type: Patch
30783

Source: CCN
Type: BID-30783
libxml2 Recursive Entity Remote Denial of Service Vulnerability

Source: SECTRACK
Type: UNKNOWN
1020728

Source: CCN
Type: USN-640-1
libxml2 vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-640-1

Source: CCN
Type: USN-644-1
libxml2 vulnerabilities

Source: MISC
Type: UNKNOWN
http://www.vmware.com/security/advisories/VMSA-2008-0017.html

Source: VUPEN
Type: UNKNOWN
ADV-2008-2419

Source: VUPEN
Type: UNKNOWN
ADV-2008-2843

Source: VUPEN
Type: UNKNOWN
ADV-2008-2971

Source: VUPEN
Type: UNKNOWN
ADV-2009-1522

Source: VUPEN
Type: UNKNOWN
ADV-2009-1621

Source: CCN
Type: XMLsoft Web site
Libxml2

Source: CONFIRM
Type: UNKNOWN
http://xmlsoft.org/news.html

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=458086

Source: XF
Type: UNKNOWN
libxml2-recursiveentity-dos(44598)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6496

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9812

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0836

Source: UBUNTU
Type: UNKNOWN
USN-644-1

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-7594

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-7395

Source: SUSE
Type: SUSE-SR:2008:018
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:xmlsoft:libxml2:2.4.19:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.4.23:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.5.11:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.11:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.12:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.13:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.14:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:*:*:*:*:*:*:*:* (Version <= 2.6.32)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:xmlsoft:libxml2:2.6.12:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.13:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.31:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.4.19:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.4.23:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.5.11:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.11:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.14:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:xmlsoft:libxml2:2.6.32:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.2:-:mac:*:*:*:*:*
  • AND
  • cpe:/o:sun:solaris:7.0::sparc:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:sun:solaris:8::sparc:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:x86_64:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1::x86-64:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/a:sun:management_center:3.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:esx_server:2.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:8.04::lts:*:*:*:*:*
  • OR cpe:/a:vmware:esx_server:3.5:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:esx_server:3.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:sun:management_center:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.7:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:1.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:3.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:4.0:beta:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:0.9:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20083281
    V
    		CVE-2008-3281
    2015-11-16
    oval:org.mitre.oval:def:29241
    P
    		RHSA-2008:0836 -- libxml2 security update (Moderate)
    2015-08-17
    oval:org.mitre.oval:def:17731
    P
    		USN-644-1 -- libxml2 vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:17756
    P
    		USN-640-1 -- libxml2 vulnerability
    2014-06-30
    oval:org.mitre.oval:def:19740
    P
    		DSA-1631-1 libxml2 - denial of service
    2014-06-23
    oval:org.mitre.oval:def:7968
    P
    		DSA-1631 libxml2 -- denial of service
    2014-06-23
    oval:org.mitre.oval:def:21731
    P
    		ELSA-2008:0836: libxml2 security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:9812
    V
    		libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
    2013-04-29
    oval:org.mitre.oval:def:6496
    V
    		Libxml2 Recursive Entity Evaluation Bug Lets Remote Users Deny Service
    2010-05-17
    oval:com.redhat.rhsa:def:20080836
    P
    		RHSA-2008:0836: libxml2 security update (Moderate)
    2008-08-26
    oval:org.debian:def:1631
    V
    		denial of service
    2008-08-22
    BACK
    xmlsoft libxml2 2.4.19
    xmlsoft libxml2 2.4.23
    xmlsoft libxml2 2.5.4
    xmlsoft libxml2 2.5.10
    xmlsoft libxml2 2.5.11
    xmlsoft libxml2 2.6.0
    xmlsoft libxml2 2.6.1
    xmlsoft libxml2 2.6.2
    xmlsoft libxml2 2.6.3
    xmlsoft libxml2 2.6.11
    xmlsoft libxml2 2.6.12
    xmlsoft libxml2 2.6.13
    xmlsoft libxml2 2.6.14
    xmlsoft libxml2 *
    xmlsoft libxml2 2.6.12
    xmlsoft libxml2 2.6.13
    xmlsoft libxml2 2.6.31
    xmlsoft libxml2 2.4.19
    xmlsoft libxml2 2.4.23
    xmlsoft libxml2 2.5.10
    xmlsoft libxml2 2.5.11
    xmlsoft libxml2 2.5.4
    xmlsoft libxml2 2.6.0
    xmlsoft libxml2 2.6.1
    xmlsoft libxml2 2.6.11
    xmlsoft libxml2 2.6.14
    xmlsoft libxml2 2.6.2
    xmlsoft libxml2 2.6.3
    xmlsoft libxml2 2.6.32
    apple safari 3.0.2 -
    sun solaris 7.0
    gentoo linux *
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    sun solaris 8
    redhat enterprise linux 3
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat linux advanced workstation 2.1
    apple safari 2.0.2
    canonical ubuntu 6.06
    apple safari 2.0.4
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 5
    redhat enterprise linux 5
    mandrakesoft mandrake linux 2007.1
    mandrakesoft mandrake linux 2008.0
    debian debian linux 4.0
    canonical ubuntu 7.04
    apple safari 3.0.1
    apple safari 3.0.2
    apple safari 3.0.3
    redhat enterprise linux 5
    canonical ubuntu 7.10
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2008.1 x86_64
    mandrakesoft mandrake linux 2007.1
    apple mac os x 10.4.11
    apple mac os x server 10.4.11
    sun management center 3.6.1
    vmware esx server 2.5.5
    apple safari 3.1
    apple safari 1.3.1
    apple safari 1.3
    apple safari 1.2
    apple safari 1.1
    apple safari 1.0
    apple safari 2.0
    apple safari 3.0
    apple safari 3.0.4
    apple safari 3.1.1
    mandrakesoft mandrake linux 2008.1
    canonical ubuntu 8.04
    vmware esx server 3.5
    apple safari 3.1.2
    vmware esx server 3.0.3
    sun management center 4.0
    apple safari 3.2
    apple safari 3.2.1
    apple safari 3.2.2
    apple mac os x 10.5.7
    apple mac os x server 10.5.7
    apple safari 1.0.3
    apple safari 1.3.2
    apple safari 0.8
    apple safari 3.2.3
    apple safari 4.0 beta
    apple safari 0.9