CVE-2015-7941

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-79426.8The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid i CVE-2015-79436.1Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and CVE-2015-79447.5The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.CVE-2015-79457.5The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.CVE-2015-79464.6Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attac CVE-2015-79617.8SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, w CVE-2015-79627.8SafeNet Authentication Service for Outlook Web App Agent uses a weak ACL for unspecified installation directories and executable modules, wh CVE-2015-79637.8SafeNet Authentication Service for AD FS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows CVE-2015-79647.8SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows l CVE-2015-79657.8SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which al CVE-2015-79667.8SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which al CVE-2015-79677.8SafeNet Authentication Service for Citrix Web Interface Agent uses a weak ACL for unspecified installation directories and executable module