9.3

CVE-2011-1944: xmlsoft libxml Numeric Errors

Modified
AliasesDEBIAN-CVE-2011-1944DSA-2255-1
Published 02-09-2011Last modified 06-08-2024

Vulnerability summary

CVE-2011-1944 is a high (CVSS 9.3) Numeric Errors vulnerability in xmlsoft libxml. EPSS estimates a 13.43% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 5 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 31-05-2011)

Source freshness unavailable

How is this decided?
CVSS score
9.3/10
010
High · v2.0 (NVD)
EPSS score
13.43%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits5reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 4 · Related 1
OPENSUSE-SU-2024:10192-1RHSA-2011:1749RHSA-2012:0017RHSA-2013:0217

Timeline

  1. 02-09-2011
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

13.43%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 13.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

5 found
  • referenceUnverified

    Exploit Reference (securityfocus.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (lists.fedoraproject.org)

    Maturity: unknown

Show all 5 exploits
  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

  • exploit-databaseremotelinuxVerified

    libxmlInvalid 2.7.x - XPath Multiple Memory Corruption Vulnerabilities

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Xmlsoft2 products
  • libxml≤ 1.8.16 | 1.5.0 | 1.6.0 | 1.6.1 | 1.6.2 | 1.7.0 | 1.7.1 | 1.7.2 | 1.7.3 | 1.7.4 | 1.8.0 | 1.8.1 | 1.8.2 | 1.8.3 | 1.8.4 | 1.8.5 | 1.8.6 | 1.8.7 | 1.8.8 | 1.8.9 | 1.8.10 | 1.8.11 | 1.8.12 | 1.8.13 | 1.8.14 | 1.8.15
  • libxml22.6.0 | 2.6.1 | 2.6.2 | 2.6.3 | 2.6.4 | 2.6.5 | 2.6.6 | 2.6.7 | 2.6.8 | 2.6.9 | 2.6.11 | 2.6.12 | 2.6.13 | 2.6.14 | 2.6.16 | 2.6.17 | 2.6.18 | 2.6.20 | 2.6.22 | 2.6.26 | 2.6.27 | 2.6.30 | 2.6.32 | 2.7.0 | 2.7.1 | 2.7.2 | 2.7.3 | 2.7.4 | 2.7.5 | 2.7.6 | 2.7.7 | 2.7.8
Debian1 product
  • libxml2< 2.6.32.dfsg-5+lenny4 | < 2.7.8.dfsg-2+squeeze1 | < 2.7.8.dfsg-3

2 vendors · 3 products

References

21 links
Show all 21 references