CVE-2012-5134

EUVD-2012-5057
Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 83%
Affected Products (NVD)
VendorProductVersion
googlechrome
𝑥
≤ 23.0.1271.89
googlechrome
23.0.1271.0
googlechrome
23.0.1271.1
googlechrome
23.0.1271.2
googlechrome
23.0.1271.3
googlechrome
23.0.1271.4
googlechrome
23.0.1271.5
googlechrome
23.0.1271.6
googlechrome
23.0.1271.7
googlechrome
23.0.1271.8
googlechrome
23.0.1271.10
googlechrome
23.0.1271.11
googlechrome
23.0.1271.12
googlechrome
23.0.1271.13
googlechrome
23.0.1271.14
googlechrome
23.0.1271.15
googlechrome
23.0.1271.16
googlechrome
23.0.1271.17
googlechrome
23.0.1271.18
googlechrome
23.0.1271.19
googlechrome
23.0.1271.20
googlechrome
23.0.1271.21
googlechrome
23.0.1271.22
googlechrome
23.0.1271.23
googlechrome
23.0.1271.24
googlechrome
23.0.1271.26
googlechrome
23.0.1271.30
googlechrome
23.0.1271.31
googlechrome
23.0.1271.32
googlechrome
23.0.1271.33
googlechrome
23.0.1271.35
googlechrome
23.0.1271.36
googlechrome
23.0.1271.37
googlechrome
23.0.1271.38
googlechrome
23.0.1271.39
googlechrome
23.0.1271.40
googlechrome
23.0.1271.41
googlechrome
23.0.1271.44
googlechrome
23.0.1271.45
googlechrome
23.0.1271.46
googlechrome
23.0.1271.49
googlechrome
23.0.1271.50
googlechrome
23.0.1271.51
googlechrome
23.0.1271.52
googlechrome
23.0.1271.53
googlechrome
23.0.1271.54
googlechrome
23.0.1271.55
googlechrome
23.0.1271.56
googlechrome
23.0.1271.57
googlechrome
23.0.1271.58
googlechrome
23.0.1271.60
googlechrome
23.0.1271.61
googlechrome
23.0.1271.62
googlechrome
23.0.1271.64
googlechrome
23.0.1271.83
googlechrome
23.0.1271.84
googlechrome
23.0.1271.85
googlechrome
23.0.1271.86
googlechrome
23.0.1271.87
googlechrome
23.0.1271.88
xmlsoftlibxml2
𝑥
≤ 2.9.0
xmlsoftlibxml2
1.7.0
xmlsoftlibxml2
1.7.1
xmlsoftlibxml2
1.7.2
xmlsoftlibxml2
1.7.3
xmlsoftlibxml2
1.7.4
xmlsoftlibxml2
1.8.0
xmlsoftlibxml2
1.8.1
xmlsoftlibxml2
1.8.2
xmlsoftlibxml2
1.8.3
xmlsoftlibxml2
1.8.4
xmlsoftlibxml2
1.8.5
xmlsoftlibxml2
1.8.6
xmlsoftlibxml2
1.8.7
xmlsoftlibxml2
1.8.9
xmlsoftlibxml2
1.8.10
xmlsoftlibxml2
1.8.13
xmlsoftlibxml2
1.8.14
xmlsoftlibxml2
1.8.16
xmlsoftlibxml2
2.0.0
xmlsoftlibxml2
2.1.0
xmlsoftlibxml2
2.1.1
xmlsoftlibxml2
2.2.0
xmlsoftlibxml2
2.2.0:beta
xmlsoftlibxml2
2.2.1
xmlsoftlibxml2
2.2.2
xmlsoftlibxml2
2.2.3
xmlsoftlibxml2
2.2.4
xmlsoftlibxml2
2.2.5
xmlsoftlibxml2
2.2.6
xmlsoftlibxml2
2.2.7
xmlsoftlibxml2
2.2.8
xmlsoftlibxml2
2.2.9
xmlsoftlibxml2
2.2.10
xmlsoftlibxml2
2.2.11
xmlsoftlibxml2
2.3.0
xmlsoftlibxml2
2.3.1
xmlsoftlibxml2
2.3.2
xmlsoftlibxml2
2.3.3
xmlsoftlibxml2
2.3.4
xmlsoftlibxml2
2.3.5
xmlsoftlibxml2
2.3.6
xmlsoftlibxml2
2.3.7
xmlsoftlibxml2
2.3.8
xmlsoftlibxml2
2.3.9
xmlsoftlibxml2
2.3.10
xmlsoftlibxml2
2.3.11
xmlsoftlibxml2
2.3.12
xmlsoftlibxml2
2.3.13
xmlsoftlibxml2
2.3.14
xmlsoftlibxml2
2.4.1
xmlsoftlibxml2
2.4.2
xmlsoftlibxml2
2.4.3
xmlsoftlibxml2
2.4.4
xmlsoftlibxml2
2.4.5
xmlsoftlibxml2
2.4.6
xmlsoftlibxml2
2.4.7
xmlsoftlibxml2
2.4.8
xmlsoftlibxml2
2.4.9
xmlsoftlibxml2
2.4.10
xmlsoftlibxml2
2.4.11
xmlsoftlibxml2
2.4.12
xmlsoftlibxml2
2.4.13
xmlsoftlibxml2
2.4.14
xmlsoftlibxml2
2.4.15
xmlsoftlibxml2
2.4.16
xmlsoftlibxml2
2.4.17
xmlsoftlibxml2
2.4.18
xmlsoftlibxml2
2.4.19
xmlsoftlibxml2
2.4.20
xmlsoftlibxml2
2.4.21
xmlsoftlibxml2
2.4.22
xmlsoftlibxml2
2.4.23
xmlsoftlibxml2
2.4.24
xmlsoftlibxml2
2.4.25
xmlsoftlibxml2
2.4.26
xmlsoftlibxml2
2.4.27
xmlsoftlibxml2
2.4.28
xmlsoftlibxml2
2.4.29
xmlsoftlibxml2
2.4.30
xmlsoftlibxml2
2.5.0
xmlsoftlibxml2
2.5.4
xmlsoftlibxml2
2.5.7
xmlsoftlibxml2
2.5.8
xmlsoftlibxml2
2.5.10
xmlsoftlibxml2
2.5.11
xmlsoftlibxml2
2.6.0
xmlsoftlibxml2
2.6.1
xmlsoftlibxml2
2.6.2
xmlsoftlibxml2
2.6.3
xmlsoftlibxml2
2.6.4
xmlsoftlibxml2
2.6.5
xmlsoftlibxml2
2.6.6
xmlsoftlibxml2
2.6.7
xmlsoftlibxml2
2.6.8
xmlsoftlibxml2
2.6.9
xmlsoftlibxml2
2.6.11
xmlsoftlibxml2
2.6.12
xmlsoftlibxml2
2.6.13
xmlsoftlibxml2
2.6.14
xmlsoftlibxml2
2.6.16
xmlsoftlibxml2
2.6.17
xmlsoftlibxml2
2.6.18
xmlsoftlibxml2
2.6.20
xmlsoftlibxml2
2.6.22
xmlsoftlibxml2
2.6.26
xmlsoftlibxml2
2.6.27
xmlsoftlibxml2
2.6.30
xmlsoftlibxml2
2.6.32
xmlsoftlibxml2
2.7.0
xmlsoftlibxml2
2.7.1
xmlsoftlibxml2
2.7.2
xmlsoftlibxml2
2.7.3
xmlsoftlibxml2
2.7.4
xmlsoftlibxml2
2.7.5
xmlsoftlibxml2
2.7.6
xmlsoftlibxml2
2.7.7
xmlsoftlibxml2
2.9.0:rc1
appleiphone_os
𝑥
≤ 6.1.4
appleiphone_os
1.0.0
appleiphone_os
1.0.1
appleiphone_os
1.0.2
appleiphone_os
1.1.0
appleiphone_os
1.1.1
appleiphone_os
1.1.2
appleiphone_os
1.1.3
appleiphone_os
1.1.4
appleiphone_os
1.1.5
appleiphone_os
2.0
appleiphone_os
2.0.0
appleiphone_os
2.0.1
appleiphone_os
2.0.2
appleiphone_os
2.1
appleiphone_os
2.1.1
appleiphone_os
2.2
appleiphone_os
2.2.1
appleiphone_os
3.0
appleiphone_os
3.0.1
appleiphone_os
3.1
appleiphone_os
3.1.2
appleiphone_os
3.1.3
appleiphone_os
3.2
appleiphone_os
3.2.1
appleiphone_os
3.2.2
appleiphone_os
4.0
appleiphone_os
4.0.1
appleiphone_os
4.0.2
appleiphone_os
4.1
appleiphone_os
4.2.1
appleiphone_os
4.2.5
appleiphone_os
4.2.8
appleiphone_os
4.3.0
appleiphone_os
4.3.1
appleiphone_os
4.3.2
appleiphone_os
4.3.3
appleiphone_os
4.3.5
appleiphone_os
5.0
appleiphone_os
5.0.1
appleiphone_os
5.1
appleiphone_os
5.1.1
appleiphone_os
6.0
appleiphone_os
6.0.1
appleiphone_os
6.0.2
appleiphone_os
6.1
appleiphone_os
6.1.2
appleiphone_os
6.1.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libxml2
bookworm
2.9.14+dfsg-1.3~deb12u1
fixed
bullseye
2.9.10+dfsg-6.7+deb11u4
fixed
bullseye (security)
2.9.10+dfsg-6.7+deb11u5
fixed
sid
2.12.7+dfsg+really2.9.14-0.1
fixed
trixie
2.12.7+dfsg+really2.9.14-0.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium-browser
hardy
dne
lucid
Fixed 3.0.1271.97-0ubuntu0.10.04.1
released
oneiric
Fixed 3.0.1271.97-0ubuntu0.11.10.1
released
precise
Fixed 3.0.1271.97-0ubuntu0.12.04.1
released
quantal
Fixed 3.0.1271.97-0ubuntu0.12.10.1
released
libxml2
hardy
Fixed 2.6.31.dfsg-2ubuntu1.11
released
lucid
Fixed 2.7.6.dfsg-1ubuntu1.7
released
oneiric
Fixed 2.7.8.dfsg-4ubuntu0.5
released
precise
Fixed 2.7.8.dfsg-5.1ubuntu4.3
released
quantal
Fixed 2.8.0+dfsg1-5ubuntu2.1
released
Common Weakness Enumeration
References
http://git.gnome.org/browse/libxml2/commit/?id=6a36fbe3b3e001a8a840b5c1fdd81cefc9947f0d
http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html
http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00023.html
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html
http://rhn.redhat.com/errata/RHSA-2012-1512.html
http://rhn.redhat.com/errata/RHSA-2013-0217.html
http://secunia.com/advisories/51448
http://secunia.com/advisories/54886
http://secunia.com/advisories/55568
http://support.apple.com/kb/HT5934
http://support.apple.com/kb/HT6001
http://www.debian.org/security/2012/dsa-2580
http://www.mandriva.com/security/advisories?name=MDVSA-2013:056
http://www.securityfocus.com/bid/56684
http://www.securitytracker.com/id?1027815
http://www.ubuntu.com/usn/USN-1656-1
https://bugzilla.redhat.com/show_bug.cgi?id=880466
https://code.google.com/p/chromium/issues/detail?id=158249
https://exchange.xforce.ibmcloud.com/vulnerabilities/80294
http://git.gnome.org/browse/libxml2/commit/?id=6a36fbe3b3e001a8a840b5c1fdd81cefc9947f0d
http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html
http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00023.html
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html
http://rhn.redhat.com/errata/RHSA-2012-1512.html
http://rhn.redhat.com/errata/RHSA-2013-0217.html
http://secunia.com/advisories/51448
http://secunia.com/advisories/54886
http://secunia.com/advisories/55568
http://support.apple.com/kb/HT5934
http://support.apple.com/kb/HT6001
http://www.debian.org/security/2012/dsa-2580
http://www.mandriva.com/security/advisories?name=MDVSA-2013:056
http://www.securityfocus.com/bid/56684
http://www.securitytracker.com/id?1027815
http://www.ubuntu.com/usn/USN-1656-1
https://bugzilla.redhat.com/show_bug.cgi?id=880466
https://code.google.com/p/chromium/issues/detail?id=158249
https://exchange.xforce.ibmcloud.com/vulnerabilities/80294