CVE-2008-4225: xmlsoft libxml Numeric Errors

Modified

AliasesDEBIAN-CVE-2008-4225

Published 25-11-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-4225 is a high (CVSS 7.8) Numeric Errors vulnerability in xmlsoft libxml. EPSS estimates a 3.21% chance of exploitation in the next 30 days, higher than 88.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v2.0 (NVD)

EPSS score

3.21%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 2

DSA-1666-1 OPENSUSE-SU-2024:10192-1 OPENSUSE-SU-2024:10228-1 RHSA-2008:0988

Timeline

25-11-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.

CVSS metrics

1 score · 1 source · 1 version

v2.07.8

EPSS trend

Probability

3.21%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.21% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-189Numeric ErrorsWeaknesses in this category are related to improper calculation or conversion of numbers.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

libxml2< 2.6.32.dfsg-5

Xmlsoft1 product

libxml2.7.2

2 vendors · 2 products

References

52 links

secunia.com/advisories/32766Third Party AdvisoryX Refsource SECUNIAVendor Advisory
support.apple.com/kb/HT3639X Refsource CONFIRM
sunsolve.sun.com/search/document.do?assetkey=1-21-141243-01-1X Refsource CONFIRM
secunia.com/advisories/32773Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2009/1621VDB EntryX Refsource VUPEN
sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1X Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2008-November/msg00513.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/32807Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlVendor AdvisoryX Refsource APPLE
www.redhat.com/archives/fedora-package-announce/2008-November/msg00472.htmlVendor AdvisoryX Refsource FEDORA

Show all 52 references

secunia.com/advisories/32764Third Party AdvisoryX Refsource SECUNIAPatch
www.vmware.com/security/advisories/VMSA-2009-0001.htmlX Refsource CONFIRM
www.ubuntu.com/usn/usn-673-1Vendor AdvisoryX Refsource UBUNTU
www.vupen.com/english/advisories/2009/0301VDB EntryX Refsource VUPEN
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10025VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/33746Third Party AdvisoryX Refsource SECUNIA
securitytracker.com/id?1021239VDB EntryX Refsource SECTRACK
admin.fedoraproject.org/updates/libxml2-2.7.2-2.fc9X Refsource CONFIRMPatch
www.vupen.com/english/advisories/2009/0034VDB EntryX Refsource VUPEN
secunia.com/advisories/34247Third Party AdvisoryX Refsource SECUNIA
support.avaya.com/elmodocs2/security/ASA-2009-067.htmX Refsource CONFIRM
www.osvdb.org/49992VDB EntryX Refsource OSVDB
secunia.com/advisories/36173Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2009/1522VDB EntryX Refsource VUPEN
sunsolve.sun.com/search/document.do?assetkey=1-26-251406-1Vendor AdvisoryX Refsource SUNALERT
security.gentoo.org/glsa/glsa-200812-06.xmlVendor AdvisoryX Refsource GENTOO
lists.apple.com/archives/security-announce/2009/Jun/msg00005.htmlVendor AdvisoryX Refsource APPLE
support.avaya.com/elmodocs2/security/ASA-2009-002.htmX Refsource CONFIRM
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473974Vendor AdvisoryX Refsource SLACKWARE
wiki.rpath.com/Advisories:rPSA-2008-0325X Refsource CONFIRM
www.debian.org/security/2008/dsa-1666Vendor AdvisoryX Refsource DEBIANPatch
secunia.com/advisories/32802Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/35379Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32974Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6415VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/33792Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/36235Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32762Third Party AdvisoryX Refsource SECUNIAVendor Advisory
sunsolve.sun.com/search/document.do?assetkey=1-66-265329-1Vendor AdvisoryX Refsource SUNALERT
www.redhat.com/support/errata/RHSA-2008-0988.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/33417Third Party AdvisoryX Refsource SECUNIA
admin.fedoraproject.org/updates/libxml2-2.7.2-2.fc10X Refsource CONFIRMPatch
sunsolve.sun.com/search/document.do?assetkey=1-66-261688-1Vendor AdvisoryX Refsource SUNALERT
bugzilla.redhat.com/show_bug.cgi?id=470480X Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2008:231Vendor AdvisoryX Refsource MANDRIVA
www.securityfocus.com/bid/32331VDB EntryX Refsource BIDPatch
support.apple.com/kb/HT3613X Refsource CONFIRM
www.vupen.com/english/advisories/2009/0323VDB EntryX Refsource VUPEN
secunia.com/advisories/32811Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2008/3176VDB EntryX Refsource VUPEN
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6234VDB EntrySignatureX Refsource OVAL
security-tracker.debian.org/tracker/CVE-2008-4225Advisory