CVE-2008-4482
Published Oct 8, 2008
Last updated 7 years ago
Overview
- Description
- The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during validation of an XML file.
- Source
- cve@mitre.org
- NVD status
- Modified
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 7.8
- Impact score
- 6.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
- nvd@nist.gov
- CWE-20
Social media
- Hype score
- Not currently trending
Vendor comments
- Red HatNot Vulnerable. Red Hat Enterprise MRG does not use Xerces-C++ in a manner that is vulnerable to this flaw.
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9217BE2F-D83B-4808-9829-F96694D9744D",
"versionEndIncluding": "2.8.0"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "568CFB1C-B7E6-4E9E-A1D2-68649ECCDC08"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "998FBACC-799E-49BA-B5D8-D8EB0A4761C8"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B48C9D91-FC42-4806-8EBA-B47E19EB3B35"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CD2F3C7-3764-4A74-A702-DEA03DDB9CC0"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2553647B-FE08-4C9E-8171-4F768DA529B8"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C7A4853-F0D3-4D24-B739-F632B5DB11B1"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D765E51D-150F-49AC-BDE0-6E59041B0434"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C835FB54-A31B-4C00-A2FD-868769B46FAE"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5C179CD-415A-41A1-8327-657F9A1CB967"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A68344B-CEB2-4A3F-8C2E-8C0D32B21525"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85DAE439-D943-4ADC-A971-A6CB0519EE49"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4CA0B545-6088-49DE-A9D9-074BCC4A7AC8"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82C0855F-7EE8-4F56-ACBB-A64855ED0FE6"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2C7BA37-EAB4-47C7-BB28-2B75BEF632AC"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB6DCE7B-2112-46A3-8E6C-013099FFB722"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F2369E73-C4A8-46ED-8A1F-6BC2E3C8D478"
},
{
"criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00E71C8D-D4DF-4F54-8CF8-D2AA67AC5690"
}
],
"operator": "OR"
}
]
}
]