CVE-2008-3281: apple iphone_os XML Entity Expansion

CVSS: 6.5v3.1MediumModified

AliasesRHSA-2008:0836DEBIAN-CVE-2008-3281DSA-1631-1+1 more

Published 27-08-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-3281 is a medium (CVSS 6.5) XML Entity Expansion vulnerability in apple iphone_os. EPSS estimates a 2.51% chance of exploitation in the next 30 days, higher than 84.4% of scored vulnerabilities.

Overall risk

27/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (NVD)

EPSS score

2.51%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

27-08-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.16.5v2.04.3

EPSS trend

Probability

2.51%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

0.00 pp

From 2.51% on 18-09-2026

18-09-202618-10-2026

EPSS score

2.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Affected systems

Redhat8 products

enterprise_linux_desktop3.0 | 4.0 | 5.0
enterprise_linux_eus4.7 | 5.2
enterprise_linux_server2.0 | 3.0 | 4.0 | 5.0
enterprise_linux_workstation2.0 | 3.0 | 4.0 | 5.0
libxml2< 0:2.4.19-9.ent | < 0:2.5.10-11 | < 0:2.6.16-12.3 | < 0:2.6.26-2.1.2.4

Show all 8

Apple2 products

iphone_os≥ 1.0.0, < 3.0
safari< 4.0

Debian2 products

libxml2< 2.6.32.dfsg-3 | < 2.6.32.dfsg-2+lenny1 | < 2.6.27.dfsg-3
debian_linuxEOL4.0

Canonical1 product

ubuntu_linuxEOL6.06 | 7.04 | 7.10 | 8.04

Fedoraproject1 product

fedoraEOL9

Vmware1 product

esx2.5.4 | 2.5.5 | 3.0.2 | 3.0.3

Xmlsoft1 product

libxml2≤ 2.6.32

7 vendors · 16 products

References

49 links

usn.ubuntu.com/644-1/Vendor AdvisoryX Refsource UBUNTUBroken Link
support.apple.com/kb/HT3639X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/31855Third Party AdvisoryX Refsource SECUNIABroken Link
www.securitytracker.com/id?1020728VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.vupen.com/english/advisories/2009/1621VDB EntryX Refsource VUPENBroken Link
www.redhat.com/archives/fedora-package-announce/2008-September/msg00347.htmlVendor AdvisoryX Refsource FEDORAMailing List
rhn.redhat.com/errata/RHSA-2008-0836.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/32807Third Party AdvisoryX Refsource SECUNIABroken Link
lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
secunia.com/advisories/31982Third Party AdvisoryX Refsource SECUNIABroken Link

Show all 49 references

www.vupen.com/english/advisories/2008/2971VDB EntryX Refsource VUPENBroken Link
www.vmware.com/security/advisories/VMSA-2008-0017.htmlX Refsource MISCThird Party Advisory
www.vupen.com/english/advisories/2008/2843VDB EntryX Refsource VUPENBroken Link
xmlsoft.org/news.htmlX Refsource CONFIRMRelease Notes
secunia.com/advisories/31590Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2009/1522VDB EntryX Refsource VUPENBroken Link
www.securityfocus.com/archive/1/497962/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.ubuntu.com/usn/usn-640-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/31728Third Party AdvisoryX Refsource SECUNIABroken Link
security.gentoo.org/glsa/glsa-200812-06.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.apple.com/archives/security-announce/2009/Jun/msg00005.htmlVendor AdvisoryX Refsource APPLEMailing List
secunia.com/advisories/32488Third Party AdvisoryX Refsource SECUNIABroken Link
lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing List
secunia.com/advisories/31566Third Party AdvisoryX Refsource SECUNIABroken Link
www.securityfocus.com/bid/30783VDB EntryX Refsource BIDBroken LinkPatchThird Party Advisory
wiki.rpath.com/Advisories:rPSA-2008-0325X Refsource CONFIRMBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6496VDB EntrySignatureX Refsource OVALBroken Link
www.vupen.com/english/advisories/2008/2419VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/35379Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2008:192Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/32974Third Party AdvisoryX Refsource SECUNIABroken Link
svn.gnome.org/viewvc/libxml2?view=revision&revision=3772X Refsource CONFIRMBroken Link
www.redhat.com/archives/fedora-package-announce/2008-September/msg00261.htmlVendor AdvisoryX Refsource FEDORAMailing List
www.debian.org/security/2008/dsa-1631Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=458086X Refsource CONFIRMIssue TrackingREPORT
mail.gnome.org/archives/xml/2008-August/msg00034.htmlMailing ListX Refsource MLISTPatch
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9812VDB EntrySignatureX Refsource OVALBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2008:180Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/31558Third Party AdvisoryX Refsource SECUNIABroken Link
support.apple.com/kb/HT3613X Refsource CONFIRMThird Party Advisory
lists.vmware.com/pipermail/security-announce/2008/000039.htmlMailing ListX Refsource MLISTBroken Link
secunia.com/advisories/31748Third Party AdvisoryX Refsource SECUNIABroken Link
access.redhat.com/errata/RHSA-2008:0836Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0836.jsonAdvisory
access.redhat.com/security/cve/CVE-2008-3281REPORT
www.cve.org/CVERecord?id=CVE-2008-3281Advisory
nvd.nist.gov/vuln/detail/CVE-2008-3281Advisory
security-tracker.debian.org/tracker/CVE-2008-3281Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities