CVE-2010-4008
MEDIUM severity · CVSS 4.3 · Memory corruption
4.3CVSS MEDIUM
Summary
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
Impact & exploitability
Attack vectorNetwork
Attack complexity—
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impactNone
Availability impact—
Exploit probability (EPSS)3%
AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://code.google.com/p/chromium/issues/detail?id=58731 ↗
Additional information
- NVD record
- http://code.google.com/p/chromium/issues/detail?id=58731Patch
- http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.htmlAdvisory
- http://blog.bkis.com/en/libxml2-vulnerability-in-google-chrome-and-apple-safari/
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.htmlAdvisory
- http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.htmlAdvisory
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.htmlAdvisory
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.htmlAdvisory