CVE-2015-7499 Heap-based buffer overflow in nokogiri
Heap-based buffer overflow in libxml2 allows attackers to obtain sensitive process memory information via unspecified vectors.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is CVE-2015-7499?
CVE-2015-7499 is a medium-severity memory corruption vulnerability in Apple Iphone Os, published on 15 Dec 2015.
Official description
Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
Weakness: CWE-119
Which versions are affected by CVE-2015-7499?
2 open source packages ship an affected version, including nokogiri. It affects 15 products.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | From 1.6.0 | 1.6.7.2 |
nokogiri RubyGems | From 1.6.0 | 1.6.7.2 |
Products include Apple Iphone Os, Apple Mac Os X, Apple Tvos, Apple Watchos, Canonical Ubuntu Linux, Debian Debian Linux and 9 more.
How do I fix CVE-2015-7499?
Upgrade nokogiri to 1.6.7.2 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2015-7499 being exploited?
There is no known exploitation of CVE-2015-7499 in the wild and no public exploit code.
Other vulnerabilities in Apple Iphone Os
Sources
Also known as DEBIAN-CVE-2015-7499, ECHO-b22b-5f50-8dd5, GHSA-jxjr-5h69-qw3w, UBUNTU-CVE-2015-7499.