The xmlCurrentChar function in libxml2 before 2.6.31 allows context-dependent attackers to cause a denial of service (infinite loop) via XML containing invalid UTF-8 sequences.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Add bug347316.patch to backport fix for bug#347316 from     upstream version

  - Add libxml2-enterprise.patch and update logos in tarball

  - Fix a couple of crash (CVE-2009-2414, CVE-2009-2416)

  - Resolves: rhbz#515236

  - two patches for size overflows problems (CVE-2008-4225,     CVE-2008-4226)

  - Resolves: rhbz#470474

  - Patch to fix an entity name copy buffer overflow     (CVE-2008-3529)

  - Resolves: rhbz#461023

  - Better fix for (CVE-2008-3281)

  - Resolves: rhbz#458095

  - change the patch for CVE-2008-3281 due to ABI issues

  - Resolves: rhbz#458095

  - Patch to fix recursive entities handling (CVE-2008-3281)

  - Resolves: rhbz#458095

  - Patch to fix UTF-8 decoding problem (CVE-2007-6284)

  - Resolves: rhbz#425933

From Red Hat Security Advisory 2008:0032 :

Updated libxml2 packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libxml2 packages provide a library that allows you to manipulate XML files. It includes support to read, modify, and write XML and HTML files.

A denial of service flaw was found in the way libxml2 processes certain content. If an application linked against libxml2 processes malformed XML content, it could cause the application to stop responding. (CVE-2007-6284)

Red Hat would like to thank the Google Security Team for responsibly disclosing this issue.

All users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

A denial of service flaw was found in the way libxml2 processes certain content. If an application linked against libxml2 processes malformed XML content, it could cause the application to stop responding. (CVE-2007-6284)

libxml2 contained a DoS condition in xmlCurrentChar()'s UTF-8 processing. CVE-2007-6284 has been assigned to this problem.

Updated libxml2 package to address a denial of service flaw.

Thanks to the Google security team for identifying and reporting this issue.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-6284 to this issue.

A denial of service flaw was discovered by the Google Security Team in the way libxml2 processes malformed XML content. This flaw could cause the application to stop responding.

The updated packages have been patched to correct this issue.

The version of VLC Media Player installed on the remote host reportedly includes versions of GnuTLS, libgcrypt, and libxml2 that are affected by various denial of service and buffer overflow vulnerabilities.

The remote host is affected by the vulnerability described in GLSA-200801-20 (libxml2: Denial of Service)

    Brad Fitzpatrick reported that the xmlCurrentChar() function does not     properly handle some UTF-8 multibyte encodings.
  Impact :

    A remote attacker could entice a user to open a specially crafted XML     document with an application using libxml2, possibly resulting in a     high CPU consumption. Note that this vulnerability could also be     triggered without user interaction by an automated system processing     XML content.
  Workaround :

    There is no known workaround at this time.

Brad Fitzpatrick discovered that libxml2 did not correctly handle certain UTF-8 sequences. If a remote attacker were able to trick a user or automated system into processing a specially crafted XML document, the application linked against libxml2 could enter an infinite loop, leading to a denial of service via CPU resource consumption.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libxml2 packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libxml2 packages provide a library that allows you to manipulate XML files. It includes support to read, modify, and write XML and HTML files.

A denial of service flaw was found in the way libxml2 processes certain content. If an application linked against libxml2 processes malformed XML content, it could cause the application to stop responding. (CVE-2007-6284)

Red Hat would like to thank the Google Security Team for responsibly disclosing this issue.

All users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

This release fixes a potential Denial of Service attack on services using libxml2 to parse user provided XML. All users are invited to upgrade. Fixes CVE-2007-6284

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brad Fitzpatrick discovered that the UTF-8 decoding functions of libxml2, the GNOME XML library, validate UTF-8 correctness insufficiently, which may lead to denial of service by forcing libxml2 into an infinite loop.

The version of VLC Media Player installed on the remote host reportedly includes versions of GnuTLS, libgcrypt and libxml2 that are affected by various denial of service and buffer overflow vulnerabilities.

ID	Name	Product	Family	Severity
79462	OracleVM 2.1 : libxml2 (OVMSA-2009-0018)	Nessus	OracleVM Local Security Checks	critical
67637	Oracle Linux 3 / 4 / 5 : libxml2 (ELSA-2008-0032)	Nessus	Oracle Linux Local Security Checks	medium
60342	Scientific Linux Security Update : libxml2 on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41179	SuSE9 Security Update : libxml2 (YOU Patch Number 12032)	Nessus	SuSE Local Security Checks	medium
40376	VMSA-2008-0006 : Updated libxml2 service console package	Nessus	VMware ESX Local Security Checks	medium
36842	Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:010)	Nessus	Mandriva Local Security Checks	medium
33278	VLC Media Player < 0.8.6h Multiple Vulnerabilities	Nessus	Windows	high
30137	GLSA-200801-20 : libxml2: Denial of Service	Nessus	Gentoo Local Security Checks	medium
30095	openSUSE 10 Security Update : libxml2 (libxml2-4841)	Nessus	SuSE Local Security Checks	medium
30094	SuSE 10 Security Update : libxml2 (ZYPP Patch Number 4840)	Nessus	SuSE Local Security Checks	medium
29979	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : libxml2 vulnerability (USN-569-1)	Nessus	Ubuntu Local Security Checks	medium
29954	RHEL 2.1 / 3 / 4 / 5 : libxml2 (RHSA-2008:0032)	Nessus	Red Hat Local Security Checks	medium
29943	Fedora 7 : libxml2-2.6.31-1.fc7 (2008-0477)	Nessus	Fedora Local Security Checks	medium
29940	Fedora 8 : libxml2-2.6.31-1.fc8 (2008-0462)	Nessus	Fedora Local Security Checks	medium
29938	Debian DSA-1461-1 : libxml2 - missing input validation	Nessus	Debian Local Security Checks	medium
29932	CentOS 3 / 4 / 5 : libxml2 (CESA-2008:0032)	Nessus	CentOS Local Security Checks	medium
4562	VLC Media Player < 0.8.6h Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2007-6284

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

high