CVE-2016-3705

The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which…

published May 17, 2016

CVSS
—
EPSS
5%
Percentile
92.3
In the wild
Unconfirmed
What it is

The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05103 · 92.3th percentile
Published
2016-05-17T14:00Z
EPSS history
Timeline
  • 17 MAY 14:00Z
    The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which…
    cvelistv5