CVE Feed

Dashboard / CVE / CVE-2015-7942

CVE-2015-7942

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.

Published:Oct 22, 2015

Last Modified:Apr 12, 2025

EPS:Nov 18, 2015

EPSS Score:0.01228

CVSS Score:6.8

Affected Products

Vendor

Product

Action

Vendor

Apple

Product

Iphone Os

Apple

Iphone Os

Vendor

Apple

Product

Mac Os X

Apple

Mac Os X

Vendor

Apple

Product

Tvos

Apple

Tvos

Vendor

Apple

Product

Watchos

Apple

Watchos

Vendor

Canonical

Product

Ubuntu Linux

Canonical

Ubuntu Linux

Vendor

Debian

Product

Debian Linux

Debian

Debian Linux

Vendor

Hp

Product

Icewall Federation Agent

Hp

Icewall Federation Agent

Vendor

Hp

Product

Icewall File Manager

Hp

Icewall File Manager

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Jboss Enterprise Web Server

Redhat

Jboss Enterprise Web Server

Vendor

Xmlsoft

Product

Libxml2

Xmlsoft

Libxml2

Exploits

https://bugzilla.gnome.org/show_bug.cgi?id=744980#c8 https://bugzilla.gnome.org/show_bug.cgi?id=756456 https://bugzilla.gnome.org/show_bug.cgi?id=744980#c8 https://bugzilla.gnome.org/show_bug.cgi?id=756456

Common Weakness Enumeration

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-122 Heap-based Buffer Overflow

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-10 Buffer Overflow via Environment Variables

CAPEC-100 Overflow Buffers

CAPEC-123 Buffer Manipulation

CAPEC-14 Client-side Injection-induced Buffer Overflow

CAPEC-24 Filter Failure through Buffer Overflow

CAPEC-42 MIME Conversion

CAPEC-44 Overflow Binary Resource File

CAPEC-45 Buffer Overflow via Symbolic Links

CAPEC-46 Overflow Variables and Tags

CAPEC-47 Buffer Overflow via Parameter Expansion

CAPEC-8 Buffer Overflow in an API Call

CAPEC-9 Buffer Overflow in Local Command-Line Utilities

CAPEC-92 Forced Integer Overflow

Related CVEs

CVE-2026-87545 (CVSS 6.5) — Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leverag…

CVE-2026-87609 (CVSS 9.6) — Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execu…

CVE-2026-87518 (CVSS 5.3) — Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote atta…

CVE-2026-87482 (CVSS 5.9) — Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 al…

CVE-2026-87517 (CVSS 3.1) — Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveragin…

CVE-2026-85047 (CVSS 9.6) — Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a…

CVE-2026-78964 (CVSS 9.6) — Use after free in Sync in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentia…

CVE-2026-78957 (CVSS 5.5) — Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtai…

CVE-2026-78981 (CVSS 6.5) — Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to poten…

CVE-2026-79105 (CVSS 4.3) — Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacke…

References

http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html

http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html

http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html

http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html

http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html

http://marc.info/?l=bugtraq&m=145382616617563&w=2

http://rhn.redhat.com/errata/RHSA-2015-2549.html

http://rhn.redhat.com/errata/RHSA-2015-2550.html

http://rhn.redhat.com/errata/RHSA-2016-1089.html

http://www.debian.org/security/2015/dsa-3430

http://www.openwall.com/lists/oss-security/2015/10/22/5

http://www.openwall.com/lists/oss-security/2015/10/22/8

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.securityfocus.com/bid/79507

http://www.securitytracker.com/id/1034243

http://www.ubuntu.com/usn/USN-2812-1

http://xmlsoft.org/news.html

https://bugzilla.gnome.org/show_bug.cgi?id=744980#c8

https://bugzilla.gnome.org/show_bug.cgi?id=756456

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172

https://security.gentoo.org/glsa/201701-37

https://support.apple.com/HT206166

https://support.apple.com/HT206167

https://support.apple.com/HT206168

https://support.apple.com/HT206169

http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html

http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html

http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html

http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html

http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html

http://marc.info/?l=bugtraq&m=145382616617563&w=2

http://rhn.redhat.com/errata/RHSA-2015-2549.html

http://rhn.redhat.com/errata/RHSA-2015-2550.html

http://rhn.redhat.com/errata/RHSA-2016-1089.html

http://www.debian.org/security/2015/dsa-3430

http://www.openwall.com/lists/oss-security/2015/10/22/5

http://www.openwall.com/lists/oss-security/2015/10/22/8

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.securityfocus.com/bid/79507

http://www.securitytracker.com/id/1034243

http://www.ubuntu.com/usn/USN-2812-1

http://xmlsoft.org/news.html

https://bugzilla.gnome.org/show_bug.cgi?id=744980#c8

https://bugzilla.gnome.org/show_bug.cgi?id=756456

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172

https://security.gentoo.org/glsa/201701-37

https://support.apple.com/HT206166

https://support.apple.com/HT206167

https://support.apple.com/HT206168

https://support.apple.com/HT206169

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High