VULNERABILITY INTELLIGENCE

CVE-2015-7941

CVSS score4.3 MEDIUM
EPSS probability3.06%
CISA KEVNot currently listed
Published2015-11-18
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:N/I:N/A:P

Description

libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.

Weakness classification

  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Primary references