CVE-2010-4008
At a glance
- Source
- NVD
- EPSS
- EPSS 2.70 % · percentile 86 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apple
- NVD status
- Modified
Description
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
Weaknesses (CWE)
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- http://secunia.com/advisories/40775
- http://secunia.com/advisories/42175
- http://mail.gnome.org/archives/xml/2010-November/msg00015.html
- http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html
- http://marc.info/?l=bugtraq&m=130331363227777&w=2
- http://www.securityfocus.com/bid/44779
- http://www.vupen.com/english/advisories/2011/0230
- http://www.vupen.com/english/advisories/2010/3046
- http://rhn.redhat.com/errata/RHSA-2013-0217.html
- http://www.ubuntu.com/usn/USN-1016-1
- http://blog.bkis.com/en/libxml2-vulnerability-in-google-chrome-and-apple-safari/
- http://secunia.com/advisories/42109
- http://support.apple.com/kb/HT4566
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
- http://www.redhat.com/support/errata/RHSA-2011-1749.html
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html
- http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.html
- http://www.vupen.com/english/advisories/2010/3100
- http://secunia.com/advisories/42314
- http://support.apple.com/kb/HT4554
- http://www.debian.org/security/2010/dsa-2128
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:243
- http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
- http://www.vupen.com/english/advisories/2010/3076
- http://support.apple.com/kb/HT4456
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12148
- http://code.google.com/p/chromium/issues/detail?id=58731
- http://marc.info/?l=bugtraq&m=139447903326211&w=2
- http://secunia.com/advisories/42429
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
- http://support.apple.com/kb/HT4581
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2010-3984
- GCVE · GCVE-0-2010-4008
CERT-FR advisories
- CERTFR-2023-AVI-0499 — Multiples vulnérabilités dans Tenable Nessus Network Monitor · cert.ssi.gouv.fr
- CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
- CERTFR-2014-AVI-480 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2012-AVI-387 — Multiples vulnérabilités dans VMware ESXi · cert.ssi.gouv.fr
- CERTA-2012-AVI-237 — Multiples vulnérabilités dans VMware · cert.ssi.gouv.fr
- CERTA-2011-AVI-243 — Vulnérabilités dans IBM Lotus Symphony · cert.ssi.gouv.fr
- CERTA-2011-AVI-240 — Multiples Vulnérabilités dans HP Systems Management Homepage · cert.ssi.gouv.fr
- CERTA-2011-AVI-162 — Multiples vulnérabilités dans Mac OS X · cert.ssi.gouv.fr
- CERTA-2011-AVI-150 — Multiples vulnérabilités dans Apple Safari · cert.ssi.gouv.fr
- CERTA-2011-AVI-134 — Multiples vulnérabilités dans iTunes · cert.ssi.gouv.fr
- CERTA-2011-AVI-039 — Multiples vulnérabilités dans OpenOffice.org · cert.ssi.gouv.fr
- CERTA-2010-AVI-565 — Multiples vulnérabilités dans Apple iOS · cert.ssi.gouv.fr
- CERTA-2010-AVI-549 — Vulnérabilité dans libxml2 · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*< 7.0.517.44cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*< 10.2cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*< 5.0.4cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*< 4.2cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*< 10.6.7cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*< 2.7.8cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:6.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*cpe:2.3:o:suse:suse_linux_enterprise_server:10:sp3:*:*:*:*:*:*cpe:2.3:o:suse:suse_linux_enterprise_server:11:-:*:*:*:*:*:*cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp1:*:*:*:*:*:*cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*≥ 2.0.0 ≤ 2.4.3cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.3.0
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |