libxml2 'XPATH' Expressions Memory Corruption Vulnerability
BID:45617
Info
libxml2 'XPATH' Expressions Memory Corruption Vulnerability
| Bugtraq ID: | 45617 |
| Class: | Unknown |
| CVE: |
CVE-2010-4494 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 02 2010 12:00AM |
| Updated: | Apr 13 2015 10:15PM |
| Credit: | Yang Dingning |
| Vulnerable: |
XMLSoft Libxml2 2.7.8 XMLSoft Libxml2 2.7.7 XMLSoft Libxml2 2.7.6 XMLSoft Libxml2 2.7.5 XMLSoft Libxml2 2.7.4 XMLSoft Libxml2 2.7.3 XMLSoft Libxml2 2.7.2 XMLSoft Libxml2 2.7.1 XMLSoft Libxml2 2.7 XMLSoft Libxml2 2.6.32 XMLSoft Libxml2 2.6.31 XMLSoft Libxml2 2.6.30 XMLSoft Libxml2 2.6.26 XMLSoft Libxml2 2.6.16 XMLSoft Libxml2 2.6.15 XMLSoft Libxml2 2.6.14 XMLSoft Libxml2 2.6.13 XMLSoft Libxml2 2.6.12 XMLSoft Libxml2 2.6.11 XMLSoft Libxml2 2.6.9 XMLSoft Libxml2 2.6.8 XMLSoft Libxml2 2.6.7 XMLSoft Libxml2 2.6.6 XMLSoft Libxml2 2.6.5 XMLSoft Libxml2 2.6.4 XMLSoft Libxml2 2.6.3 XMLSoft Libxml2 2.6.2 XMLSoft Libxml2 2.6.1 XMLSoft Libxml2 2.6.9 XMLSoft Libxml2 2.6.8 XMLSoft Libxml2 2.6.7 XMLSoft Libxml2 2.6.6 XMLSoft Libxml2 2.6.5 XMLSoft Libxml2 2.6.4 XMLSoft Libxml2 2.6.3 XMLSoft Libxml2 2.6.27 VMWare ESXi 5.0 VMWare ESXi 4.1 VMWare ESXi 4.0 VMWare ESXi 3.5 SuSE SUSE Linux Enterprise Software Development Kit 11 SP1 SuSE SUSE Linux Enterprise Server 11 SP1 SuSE SUSE Linux Enterprise SDK 11 SP1 SuSE Suse Linux Enterprise Desktop 11 SP1 SuSE SUSE Linux Enterprise 11 SP1 S.u.S.E. openSUSE 11.3 S.u.S.E. openSUSE 11.2 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Novell Suse Linux 11 Sp1 Server Novell Suse Linux 11 Sp1 Desktop Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 IBM Lotus Symphony 3.0.0 FP 1 IBM Lotus Symphony 3.0.0 HP Rapid Deployment Pack (RDP) 0 HP Insight Control Server Deployment 0 Google Chrome 8.0.552.214 Google Chrome 8.0.552.213 Google Chrome 8.0.552.212 Google Chrome 8.0.552.211 Google Chrome 8.0.552.210 Google Chrome 8.0.552.21 Google Chrome 8.0.552.209 Google Chrome 8.0.552.208 Google Chrome 8.0.552.207 Google Chrome 8.0.552.206 Google Chrome 8.0.552.205 Google Chrome 8.0.552.204 Google Chrome 8.0.552.203 Google Chrome 8.0.552.202 Google Chrome 8.0.552.201 Google Chrome 8.0.552.200 Google Chrome 8.0.552.20 Google Chrome 8.0.552.2 Google Chrome 8.0.552.19 Google Chrome 8.0.552.18 Google Chrome 8.0.552.17 Google Chrome 8.0.552.16 Google Chrome 8.0.552.15 Google Chrome 8.0.552.14 Google Chrome 8.0.552.13 Google Chrome 8.0.552.12 Google Chrome 8.0.552.11 Google Chrome 8.0.552.105 Google Chrome 8.0.552.104 Google Chrome 8.0.552.103 Google Chrome 8.0.552.102 Google Chrome 8.0.552.101 Google Chrome 8.0.552.100 Google Chrome 8.0.552.10 Google Chrome 8.0.552.1 Google Chrome 8.0.552.0 Google Chrome 8.0.551.1 Google Chrome 8.0.551.0 Google Chrome 8.0.550.0 Google Chrome 8.0.549.0 Google Chrome 7.0.548.0 Google Chrome 7.0.547.1 Google Chrome 7.0.547.0 Google Chrome 7.0.544.0 Google Chrome 7.0.542.0 Google Chrome 7.0.541.0 Google Chrome 7.0.540.0 Google Chrome 7.0.539.0 Google Chrome 7.0.538.0 Google Chrome 7.0.537.0 Google Chrome 7.0.536.4 Google Chrome 7.0.536.3 Google Chrome 7.0.536.2 Google Chrome 7.0.536.1 Google Chrome 7.0.536.0 Google Chrome 7.0.535.2 Google Chrome 7.0.535.1 Google Chrome 7.0.531.2 Google Chrome 7.0.531.1 Google Chrome 7.0.531.0 Google Chrome 7.0.530.0 Google Chrome 7.0.529.2 Google Chrome 7.0.529.1 Google Chrome 7.0.529.0 Google Chrome 7.0.528.0 Google Chrome 7.0.526.0 Google Chrome 7.0.525.0 Google Chrome 7.0.524.0 Google Chrome 7.0.522.0 Google Chrome 7.0.521.0 Google Chrome 7.0.520.0 Google Chrome 7.0.519.0 Google Chrome 7.0.518.0 Google Chrome 7.0.517.9 Google Chrome 7.0.517.8 Google Chrome 7.0.517.7 Google Chrome 7.0.517.6 Google Chrome 7.0.517.5 Google Chrome 7.0.517.44 Google Chrome 7.0.517.43 Google Chrome 7.0.517.42 Google Chrome 7.0.517.41 Google Chrome 7.0.517.40 Google Chrome 7.0.517.4 Google Chrome 7.0.517.39 Google Chrome 7.0.517.38 Google Chrome 7.0.517.37 Google Chrome 7.0.517.36 Google Chrome 7.0.517.35 Google Chrome 7.0.517.34 Google Chrome 7.0.517.33 Google Chrome 7.0.517.32 Google Chrome 7.0.517.31 Google Chrome 7.0.517.30 Google Chrome 7.0.517.29 Google Chrome 7.0.517.28 Google Chrome 7.0.517.27 Google Chrome 7.0.517.26 Google Chrome 7.0.517.25 Google Chrome 7.0.517.24 Google Chrome 7.0.517.23 Google Chrome 7.0.517.22 Google Chrome 7.0.517.21 Google Chrome 7.0.517.20 Google Chrome 7.0.517.2 Google Chrome 7.0.517.19 Google Chrome 7.0.517.18 Google Chrome 7.0.517.17 Google Chrome 7.0.517.16 Google Chrome 7.0.517.14 Google Chrome 7.0.517.13 Google Chrome 7.0.517.12 Google Chrome 7.0.517.11 Google Chrome 7.0.517.10 Google Chrome 7.0.517.0 Google Chrome 7.0.516.0 Google Chrome 7.0.515.0 Google Chrome 7.0.514.1 Google Chrome 7.0.514.0 Google Chrome 7.0.513.0 Google Chrome 7.0.512.0 Google Chrome 7.0.511.4 Google Chrome 7.0.511.2 Google Chrome 7.0.511.1 Google Chrome 7.0.510.0 Google Chrome 7.0.509.0 Google Chrome 7.0.507.3 Google Chrome 7.0.507.2 Google Chrome 7.0.507.1 Google Chrome 7.0.507.0 Google Chrome 7.0.506.0 Google Chrome 7.0.505.0 Google Chrome 7.0.504.0 Google Chrome 7.0.503.1 Google Chrome 7.0.503.0 Google Chrome 7.0.500.1 Google Chrome 7.0.500.0 Google Chrome 7.0.499.1 Google Chrome 7.0.499.0 Google Chrome 7.0.498.0 Google Chrome 7.0.497.0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 CentOS CentOS 6 Avaya Aura Experience Portal 6.0 Apple Safari 4.1.2 for Windows Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1.3 for Windows Apple Safari 4.1.3 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4.0 Beta Apple Safari 4.0 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple Mobile Safari 0 Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.6 Apple iTunes 9.2.1 Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 9.2 Apple iTunes 9.1 Apple iTunes 10.1 Apple iTunes 10 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 2.1 Apple iOS 2.0 |
| Not Vulnerable: |
IBM Lotus Symphony 3.0.0 FP 2 Google Chrome 8.0.552.215 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Mac OS X Server 10.6.7 Apple Mac OS X 10.6.7 Apple iTunes 10.2 Apple iOS 4.3 |
Discussion
libxml2 'XPATH' Expressions Memory Corruption Vulnerability
The 'libxml2' library is prone to a memory-corruption vulnerability.
An attacker can exploit this issue by tricking a victim into opening a specially crafted XML file.
A successful attack can allow attacker-supplied code to run in the context of the application using the vulnerable library or can cause a denial-of-service condition.
NOTE: This issue was previously discussed in BID 45170 (Google Chrome prior to 8.0.552.215 Multiple Security Vulnerabilities) but has been given its own record to better document it.
The 'libxml2' library is prone to a memory-corruption vulnerability.
An attacker can exploit this issue by tricking a victim into opening a specially crafted XML file.
A successful attack can allow attacker-supplied code to run in the context of the application using the vulnerable library or can cause a denial-of-service condition.
NOTE: This issue was previously discussed in BID 45170 (Google Chrome prior to 8.0.552.215 Multiple Security Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
libxml2 'XPATH' Expressions Memory Corruption Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
libxml2 'XPATH' Expressions Memory Corruption Vulnerability
Solution:
Updates are available. Please see the references for more information.
Mandriva Linux Mandrake 2009.0 x86_64
Apple Safari 5.0.3 for Windows
MandrakeSoft Enterprise Server 5
Apple iTunes 10.1
Apple Mac OS X Server 10.6.6
Solution:
Updates are available. Please see the references for more information.
Mandriva Linux Mandrake 2009.0 x86_64
-
Mandriva lib64xml2-devel-2.7.1-1.6mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva lib64xml2_2-2.7.1-1.6mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva libxml2-python-2.7.1-1.6mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva libxml2-utils-2.7.1-1.6mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/
Apple Safari 5.0.3 for Windows
-
Apple APPLE-SA-2011-03-09-2 Safari_Setup.exe
Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2011-03-09-2 SafariQuickTimeSetup.exe
Safari+QuickTime for Windows 7, Vista or XP
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2011-03-09-2 SafariSetup.exe
Safari for Windows 7, Vista or XP
http://www.apple.com/safari/download/
MandrakeSoft Enterprise Server 5
-
Mandriva libxml2-devel-2.7.1-1.6mdvmes5.1.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libxml2-python-2.7.1-1.6mdvmes5.1.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libxml2-utils-2.7.1-1.6mdvmes5.1.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libxml2_2-2.7.1-1.6mdvmes5.1.i586.rpm
http://www.mandriva.com/en/download/
Apple iTunes 10.1
-
Apple APPLE-SA-2011-03-02-1 iTunes64Setup.exe
For 64-bit Windows XP / Vista / Windows 7
http://www.apple.com/itunes/download/ -
Apple APPLE-SA-2011-03-02-1 iTunesSetup.exe
For Windows XP / Vista / Windows 7
http://www.apple.com/itunes/download/ -
Apple iTunes10.2.dmg
for Mac OS X
http://www.apple.com/itunes/download/
Apple Mac OS X Server 10.6.6
-
Apple MacOSXServerUpd10.6.7.dmg
For Mac OS X Server v10.6.6
http://www.apple.com/support/downloads/
References
libxml2 'XPATH' Expressions Memory Corruption Vulnerability
References:
References:
- libxml2 Homepage (xmlsoft)
- Security: possible memory corruption (double-free) in XPath processing code (Google)
- Stable, Beta Channel Updates - 8.0.552.215 (Google)
- ASA-2011-411 (Avaya)
- CVE-2010-4494 (Novell)
- HPSBGN02970 rev.1 - HP Rapid Deployment Pack (RDP) or HP Insight Control Server (HP)
- IBM Lotus Symphony 3.0 Component Fix Pack 2 Release Notes (IBM)
- openSUSE-SU-2011:0255-1 (OpenSUSE)