CVE DATABASE / CVE-2008-3281
CVE-2008-3281
CVSS 6.5 · MEDIUM
Summary
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
CVSS 3.1 breakdown
| Base score | 6.5 (MEDIUM) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| Attack vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity | NONE |
| Availability | HIGH |
Weakness type (CWE)
Affected products
Xmlsoft libxml2Apple safariApple iphone osFedoraproject fedoraCanonical ubuntu linuxDebian debian linuxRedhat enterprise linux desktopRedhat enterprise linux eusRedhat enterprise linux serverRedhat enterprise linux workstationVmware esx
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
- http://lists.vmware.com/pipermail/security-announce/2008/000039.html
- http://mail.gnome.org/archives/xml/2008-August/msg00034.html
- http://secunia.com/advisories/31558
- http://secunia.com/advisories/31566
- http://secunia.com/advisories/31590
- http://secunia.com/advisories/31728
- http://secunia.com/advisories/31748
- http://secunia.com/advisories/31855
- http://secunia.com/advisories/31982
- http://secunia.com/advisories/32488
- http://secunia.com/advisories/32807
- http://secunia.com/advisories/32974
Data: NIST NVD. NVD last modified 2026-04-23. Always verify against the vendor advisory before acting.