XMLSoft libxml2 2.9.1 tree.c xmlStaticCopyNodeList denial of service

Summaryinfo

A vulnerability described as problematic has been identified in XMLSoft libxml2 2.9.1. This issue affects the function xmlStaticCopyNodeList of the file tree.c. Such manipulation with the input NULL leads to denial of service. There is not any exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in XMLSoft libxml2 2.9.1 (Document Processing Software). Affected by this issue is the function xmlStaticCopyNodeList of the file tree.c. The manipulation with the input value NULL leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.

The weakness was released 11/29/2013 by Phil Shafer as Bug 708681 as confirmed bug report (Bugzilla). The advisory is shared for download at bugzilla.gnome.org. The public release was coordinated with the vendor. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The following code is the reason for this vulnerability:

#endif /* LIBXML_TREE_ENABLED */
   q = xmlStaticCopyNode(node, doc, parent, 1);
   if (ret == NULL) {
      q->prev = NULL;
      ret = p = q;

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.gnome.org. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at OSVDB (101273†). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Document Processing Software

Vendor

• XMLSoft

Name

• libxml2

Version

• 2.9.1

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion