CVE-2004-0110

Current Description

Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.

Basic Data

PublishedMarch 15, 2004
Last ModifiedOctober 11, 2017
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeNVD-CWE-Other
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityLOW
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score7.5
SeverityHIGH
Exploitability Score10.0
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegetrue

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationSgiPropack2.3*******
    2.3ApplicationSgiPropack2.4*******
    2.3ApplicationXmlsoftLibxml1.8.17*******
    2.3ApplicationXmlsoftLibxml22.4.19*******
    2.3ApplicationXmlsoftLibxml22.4.23*******
    2.3ApplicationXmlsoftLibxml22.5.4*******
    2.3ApplicationXmlsoftLibxml22.5.10*******
    2.3ApplicationXmlsoftLibxml22.5.11*******
    2.3ApplicationXmlsoftLibxml22.6.0*******
    2.3ApplicationXmlsoftLibxml22.6.1*******
    2.3ApplicationXmlsoftLibxml22.6.2*******
    2.3ApplicationXmlsoftLibxml22.6.3*******
    2.3ApplicationXmlsoftLibxml22.6.4*******
    2.3ApplicationXmlsoftLibxml22.6.5*******

Vulnerable Software List

VendorProductVersions
Xmlsoft Libxml2 2.4.19, 2.4.23, 2.5.10, 2.5.11, 2.5.4, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5
Xmlsoft Libxml 1.8.17
Sgi Propack 2.3, 2.4

References

NameSourceURLTags
20040305 [OpenPKG-SA-2004.003] OpenPKG Security Advisory (libxml)http://marc.info/?l=bugtraq&m=107851606605420&w=2BUGTRAQ
20040306 TSLSA-2004-0010 - libxml2http://marc.info/?l=bugtraq&m=107860178228804&w=2BUGTRAQ
RHSA-2004:090http://rhn.redhat.com/errata/RHSA-2004-090.htmlREDHATPATCH Vendor Advisory
10958http://secunia.com/advisories/10958/SECUNIA
GLSA-200403-01http://security.gentoo.org/glsa/glsa-200403-01.xmlGENTOO
O-086http://www.ciac.org/ciac/bulletins/o-086.shtmlCIAC
DSA-455http://www.debian.org/security/2004/dsa-455DEBIAN
VU#493966http://www.kb.cert.org/vuls/id/493966CERT-VNUS Government Resource
SUSE-SR:2005:001http://www.novell.com/linux/security/advisories/2005_01_sr.htmlSUSE
RHSA-2004:091http://www.redhat.com/support/errata/RHSA-2004-091.htmlREDHAT
RHSA-2004:650http://www.redhat.com/support/errata/RHSA-2004-650.htmlREDHAT
9718http://www.securityfocus.com/bid/9718BIDPATCH Vendor Advisory
http://www.xmlsoft.org/news.htmlhttp://www.xmlsoft.org/news.htmlCONFIRM
libxml2-nanohttp-bo(15301)https://exchange.xforce.ibmcloud.com/vulnerabilities/15301XF
libxml2-nanoftp-bo(15302)https://exchange.xforce.ibmcloud.com/vulnerabilities/15302XF
oval:org.mitre.oval:def:11626https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11626OVAL
oval:org.mitre.oval:def:833https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A833OVAL
oval:org.mitre.oval:def:875https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A875OVAL