9.8
CVE-2015-8710
- EPSS 4.93%
- Veröffentlicht 11.04.2016 21:59:15
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Quelle security@debian.org
- CVE-Watchlists
- Unerledigt
LoginThe htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 4.93% | 0.911 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
http://rhn.redhat.com/errata/RHSA-2016-1089.html
http://www.debian.org/security/2015/dsa-3430
http://www.openwall.com/lists/oss-security/2015/04/19/4
http://www.openwall.com/lists/oss-security/2015/09/13/1
http://www.openwall.com/lists/oss-security/2015/12/31/7
http://www.securityfocus.com/bid/79811
https://bugzilla.gnome.org/show_bug.cgi?id=746048
https://git.gnome.org/browse/libxml2/commit/?id=e724879d964d774df9b7969fc846605aa1bac54c
https://hackerone.com/reports/57125#activity-384861