The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
CVSS Details
- CVSS 3.1 Base Score: 7.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxml2 | Aug 30, 2017 | Dec 15, 2015 |
| Amazon Linux Ami 2 | — | Upgrade libxml2-pythonUpgrade libxml2-staticUpgrade libxml2-develUpgrade libxml2-debuginfoUpgrade libxml2 | Apr 27, 2020 | Dec 15, 2015 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Jun 5, 2017 | Jul 18, 2016 |
| Apple Osx Libxml2 | — | Upgrade macOS to the latest versionApply OS X security update 2016-004 | Jun 6, 2017 | Dec 15, 2015 |
| Centos_linux | — | Upgrade libxml2Upgrade libxml2-develUpgrade libxml2-staticUpgrade libxml2-python | Dec 1, 2016 | Dec 15, 2015 |
| Debian | — | Upgrade libxml2 | Jan 4, 2016 | Dec 15, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 15, 2016 |
| Oracle Solaris | — | Upgrade library/python/libxml2-27 to version 2.9.3-0.175.3.5.0.2.0 on Solaris 11.3Upgrade library/libxml2 to version 2.9.3-0.175.3.5.0.2.0 on Solaris 11.3Upgrade library/python/libxml2-26 to version 2.9.3-0.175.3.5.0.2.0 on Solaris 11.3Upgrade library/python/libxml2-34 to version 2.9.3-0.175.3.5.0.2.0 on Solaris 11.3 | May 29, 2017 | Dec 15, 2015 |
| Oracle_linux | — | Upgrade libxml2-develUpgrade libxml2Upgrade libxml2-staticUpgrade libxml2-python | Oct 16, 2024 | Dec 15, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 29, 2015 |
| Suse | — | Upgrade libxml2-develUpgrade libxml2-2Upgrade libxml2-pythonUpgrade ruby2.5-rubygem-nokogiriUpgrade libxml2-toolsUpgrade libxml2-2-32bitUpgrade python-libxml2Upgrade libxml2-docUpgrade libxml2Upgrade libxml2-32bitUpgrade libxml2-x86Upgrade libxml2-devel-32bitUpgrade sles12-docker-image | Jan 4, 2016 | Dec 15, 2015 |
| Ubuntu | — | Upgrade libxml2 | Dec 14, 2015 | Dec 14, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub