CVE-2015-7941

libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.

• How can I get the fixes?
• What do statuses mean?
• Patch details

References

• MITRE
• NVD
• Launchpad
• Debian

Related Ubuntu Security Notices (USN)

• USN-2812-1
• libxml2 vulnerabilities
• 16 November 2015

Other references

• http://www.openwall.com/lists/oss-security/2015/04/19/5
• http://www.openwall.com/lists/oss-security/2015/10/22/5
• https://www.cve.org/CVERecord?id=CVE-2015-7941