CVE-2011-1944 Integer overflow in n/a
Integer overflow in libxml2 allows attackers to cause denial of service or execute arbitrary code via crafted XML files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2011-1944?
CVE-2011-1944 is a critical vulnerability in Xmlsoft Libxml2, published on 2 Sep 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.
Weakness: CWE-189
Which versions are affected by CVE-2011-1944?
It affects 2 products.
Products include Xmlsoft Libxml, Xmlsoft Libxml2.
How do I fix CVE-2011-1944?
Upgrade to a fixed version.
Is CVE-2011-1944 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-1944 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Xmlsoft Libxml2
Sources
Also known as DEBIAN-CVE-2011-1944, DSA-2255-1, GHSA-447f-hj4w-5xch.