CVE-2010-4008
En bref
- Source
- NVD
- EPSS
- EPSS 2.70 % · centile 86 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apple
- Statut NVD
- Modified
Description
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
Faiblesses (CWE)
- CWE-119 — Opération hors des limites d'un tampon mémoire
Références
- http://secunia.com/advisories/40775
- http://secunia.com/advisories/42175
- http://mail.gnome.org/archives/xml/2010-November/msg00015.html
- http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html
- http://marc.info/?l=bugtraq&m=130331363227777&w=2
- http://www.securityfocus.com/bid/44779
- http://www.vupen.com/english/advisories/2011/0230
- http://www.vupen.com/english/advisories/2010/3046
- http://rhn.redhat.com/errata/RHSA-2013-0217.html
- http://www.ubuntu.com/usn/USN-1016-1
- http://blog.bkis.com/en/libxml2-vulnerability-in-google-chrome-and-apple-safari/
- http://secunia.com/advisories/42109
- http://support.apple.com/kb/HT4566
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
- http://www.redhat.com/support/errata/RHSA-2011-1749.html
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html
- http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.html
- http://www.vupen.com/english/advisories/2010/3100
- http://secunia.com/advisories/42314
- http://support.apple.com/kb/HT4554
- http://www.debian.org/security/2010/dsa-2128
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:243
- http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
- http://www.vupen.com/english/advisories/2010/3076
- http://support.apple.com/kb/HT4456
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12148
- http://code.google.com/p/chromium/issues/detail?id=58731
- http://marc.info/?l=bugtraq&m=139447903326211&w=2
- http://secunia.com/advisories/42429
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
- http://support.apple.com/kb/HT4581
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2010-3984
- GCVE · GCVE-0-2010-4008
Avis du CERT-FR
- CERTFR-2023-AVI-0499 — Multiples vulnérabilités dans Tenable Nessus Network Monitor · cert.ssi.gouv.fr
- CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
- CERTFR-2014-AVI-480 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2012-AVI-387 — Multiples vulnérabilités dans VMware ESXi · cert.ssi.gouv.fr
- CERTA-2012-AVI-237 — Multiples vulnérabilités dans VMware · cert.ssi.gouv.fr
- CERTA-2011-AVI-243 — Vulnérabilités dans IBM Lotus Symphony · cert.ssi.gouv.fr
- CERTA-2011-AVI-240 — Multiples Vulnérabilités dans HP Systems Management Homepage · cert.ssi.gouv.fr
- CERTA-2011-AVI-162 — Multiples vulnérabilités dans Mac OS X · cert.ssi.gouv.fr
- CERTA-2011-AVI-150 — Multiples vulnérabilités dans Apple Safari · cert.ssi.gouv.fr
- CERTA-2011-AVI-134 — Multiples vulnérabilités dans iTunes · cert.ssi.gouv.fr
- CERTA-2011-AVI-039 — Multiples vulnérabilités dans OpenOffice.org · cert.ssi.gouv.fr
- CERTA-2010-AVI-565 — Multiples vulnérabilités dans Apple iOS · cert.ssi.gouv.fr
- CERTA-2010-AVI-549 — Vulnérabilité dans libxml2 · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*< 7.0.517.44cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*< 10.2cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*< 5.0.4cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*< 4.2cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*< 10.6.7cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*< 2.7.8cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:6.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*cpe:2.3:o:suse:suse_linux_enterprise_server:10:sp3:*:*:*:*:*:*cpe:2.3:o:suse:suse_linux_enterprise_server:11:-:*:*:*:*:*:*cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp1:*:*:*:*:*:*cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*≥ 2.0.0 ≤ 2.4.3cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.3.0
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |