VULNERABILITY INTELLIGENCE
CVE-2010-4008
CVSS score4.3 MEDIUM
EPSS probability2.70%
CISA KEVNot currently listed
Published2010-11-17
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:N/I:N/A:P
Description
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
Weakness classification
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Primary references
- product-security@apple.com — Broken Link
- product-security@apple.com — Exploit, Issue Tracking, Patch, Vendor Advisory
- product-security@apple.com — Vendor Advisory
- product-security@apple.com — Mailing List, Third Party Advisory
- product-security@apple.com — Mailing List, Third Party Advisory
- product-security@apple.com — Mailing List, Third Party Advisory
- product-security@apple.com — Mailing List, Third Party Advisory
- product-security@apple.com — Mailing List, Third Party Advisory
- product-security@apple.com — Mailing List, Release Notes, Vendor Advisory
- product-security@apple.com — Third Party Advisory
- product-security@apple.com — Third Party Advisory
- product-security@apple.com — Third Party Advisory