CVE-2012-5134
Fixed in a distro release EPSS 4%
Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document.
Products: google chrome, xmlsoft libxml2, apple iphone_os
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libxml2 | 2.8.0+dfsg1-7 |
| Debian 13 | libxml2 | 2.8.0+dfsg1-7 |
| Debian 14 | libxml2 | 2.8.0+dfsg1-7 |
| Debian 6.0 | libxml2 | 2.7.8.dfsg-2+squeeze6 |
| Red Hat Enterprise Linux 5 | libxml2 | 0:2.6.26-2.1.15.el5_8.6 |
| Red Hat Enterprise Linux 5 | libxml2-debuginfo | 0:2.6.26-2.1.15.el5_8.6 |
| Red Hat Enterprise Linux 5 | libxml2-devel | 0:2.6.26-2.1.15.el5_8.6 |
| Red Hat Enterprise Linux 5 | libxml2-python | 0:2.6.26-2.1.15.el5_8.6 |
| Red Hat Enterprise Linux 6 | libxml2 | 0:2.7.6-8.el6_3.4 |
| Red Hat Enterprise Linux 6 | libxml2-debuginfo | 0:2.7.6-8.el6_3.4 |
| Red Hat Enterprise Linux 6 | libxml2-devel | 0:2.7.6-8.el6_3.4 |
| Red Hat Enterprise Linux 6 | libxml2-python | 0:2.7.6-8.el6_3.4 |
| Red Hat Enterprise Linux 6 | libxml2-static | 0:2.7.6-8.el6_3.4 |
| Red Hat Enterprise Linux 6 | mingw32-libxml2 | 0:2.7.6-6.el6_3 |
| Red Hat Enterprise Linux 6 | mingw32-libxml2-debuginfo | 0:2.7.6-6.el6_3 |
| Red Hat Enterprise Linux 6 | mingw32-libxml2-static | 0:2.7.6-6.el6_3 |
| openSUSE Tumbleweed | chromium | 113.0.5672.92-1.1 |
| openSUSE Tumbleweed | chromium | 55.0.2883.75-3.1 |
| openSUSE Tumbleweed | libxml2 | 2.9.4-1.22 |
| openSUSE Tumbleweed | python-libxml2 | 2.9.4-1.4 |