GCVE - cpe:2.3:a:xmlsoft:libxml2:1.8.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:xmlsoft:libxml2:1.8.0:*:*:*:*:*:*:*

part: a version: 1.8.0 update: *

Vendor	Xmlsoft (`be3c3366-cde4-54a5-8785-eb1f04df6881`)
Product	Libxml2 (`b6949b35-db17-5df6-ad91-0baa70a48eb5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/libxml2`	purl2cpe	2026-06-01 10:12:19.601307
`pkg:deb/ubuntu/libxml2`	purl2cpe	2026-06-01 10:12:19.601308
`pkg:github/gnome/libxml2`	purl2cpe	2026-06-01 10:12:19.601309
`pkg:gitlab/redhat/libxml2`	purl2cpe	2026-06-01 10:12:19.601311
`pkg:rpm/fedora/libxml2`	purl2cpe	2026-06-01 10:12:19.601312
`pkg:rpm/opensuse/libxml2`	purl2cpe	2026-06-01 10:12:19.601313

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-2877`	vulnerable	2026-06-08 05:04:28.572941	Details available parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state. Published: 2013-07-10T10:00:00.000Z Updated: 2024-08-06T15:52:20.586Z Open on db.gcve.eu Reference links http://www.debian.org/security/2013/dsa-2779 http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://www.securityfocus.com/bid/61050 http://www.securityfocus.com/archive/1/534161/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0339`	vulnerable	2026-06-08 05:03:47.229033	Details available libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE. Published: 2014-01-21T18:00:00.000Z Updated: 2024-08-06T14:25:09.789Z Open on db.gcve.eu Reference links http://secunia.com/advisories/52662 http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html http://openwall.com/lists/oss-security/2013/02/21/24 http://openwall.com/lists/oss-security/2013/02/22/3 http://seclists.org/oss-sec/2013/q4/188	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0338`	vulnerable	2026-06-08 05:03:47.156919	Details available libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity. Published: 2013-04-25T23:00:00.000Z Updated: 2024-08-06T14:25:09.526Z Open on db.gcve.eu Reference links http://secunia.com/advisories/52662 http://lists.opensuse.org/opensuse-updates/2013-03/msg00114.html http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html https://bugzilla.redhat.com/show_bug.cgi?id=912400 http://lists.opensuse.org/opensuse-updates/2013-03/msg00112.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5134`	vulnerable	2026-06-08 05:02:54.458272	Details available Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document. Published: 2012-11-28T01:00:00.000Z Updated: 2024-08-06T20:58:02.682Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=880466 http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00004.html http://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0841`	vulnerable	2026-06-08 05:00:45.774773	Details available libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data. Published: 2012-12-21T02:00:00.000Z Updated: 2024-08-06T18:38:14.956Z Open on db.gcve.eu Reference links http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html http://rhn.redhat.com/errata/RHSA-2012-0324.html http://www.openwall.com/lists/oss-security/2012/02/22/1 http://rhn.redhat.com/errata/RHSA-2013-0217.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.