GCVE - cpe:2.3:a:xmlsoft:libxml2:2.6.25:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:xmlsoft:libxml2:2.6.25:*:*:*:*:*:*:*

part: a version: 2.6.25 update: *

Vendor	Xmlsoft (`be3c3366-cde4-54a5-8785-eb1f04df6881`)
Product	Libxml2 (`b6949b35-db17-5df6-ad91-0baa70a48eb5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/libxml2`	purl2cpe	2026-06-01 10:12:19.602578
`pkg:deb/ubuntu/libxml2`	purl2cpe	2026-06-01 10:12:19.602580
`pkg:github/gnome/libxml2`	purl2cpe	2026-06-01 10:12:19.602581
`pkg:gitlab/redhat/libxml2`	purl2cpe	2026-06-01 10:12:19.602582
`pkg:rpm/fedora/libxml2`	purl2cpe	2026-06-01 10:12:19.602584
`pkg:rpm/opensuse/libxml2`	purl2cpe	2026-06-01 10:12:19.602585

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-3660`	vulnerable	2026-06-08 05:05:42.249969	Details available parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack. Published: 2014-11-04T16:00:00.000Z Updated: 2024-08-06T10:50:17.928Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://secunia.com/advisories/59903 https://www.ncsc.nl/actueel/nieuwsberichten/kwetsbaarheid-ontdekt-in-libxml2.html http://www.debian.org/security/2014/dsa-3057 https://support.apple.com/kb/HT205030	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2877`	vulnerable	2026-06-08 05:04:28.624741	Details available parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state. Published: 2013-07-10T10:00:00.000Z Updated: 2024-08-06T15:52:20.586Z Open on db.gcve.eu Reference links http://www.debian.org/security/2013/dsa-2779 http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://www.securityfocus.com/bid/61050 http://www.securityfocus.com/archive/1/534161/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0339`	vulnerable	2026-06-08 05:03:47.230794	Details available libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE. Published: 2014-01-21T18:00:00.000Z Updated: 2024-08-06T14:25:09.789Z Open on db.gcve.eu Reference links http://secunia.com/advisories/52662 http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html http://openwall.com/lists/oss-security/2013/02/21/24 http://openwall.com/lists/oss-security/2013/02/22/3 http://seclists.org/oss-sec/2013/q4/188	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0338`	vulnerable	2026-06-08 05:03:47.214324	Details available libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity. Published: 2013-04-25T23:00:00.000Z Updated: 2024-08-06T14:25:09.526Z Open on db.gcve.eu Reference links http://secunia.com/advisories/52662 http://lists.opensuse.org/opensuse-updates/2013-03/msg00114.html http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html https://bugzilla.redhat.com/show_bug.cgi?id=912400 http://lists.opensuse.org/opensuse-updates/2013-03/msg00112.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0841`	vulnerable	2026-06-08 05:00:45.832547	Details available libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data. Published: 2012-12-21T02:00:00.000Z Updated: 2024-08-06T18:38:14.956Z Open on db.gcve.eu Reference links http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html http://rhn.redhat.com/errata/RHSA-2012-0324.html http://www.openwall.com/lists/oss-security/2012/02/22/1 http://rhn.redhat.com/errata/RHSA-2013-0217.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.