VYPR
Medium severity6.5NVD Advisory· Published Aug 27, 2008· Updated Apr 23, 2026

CVE-2008-3281

CVE-2008-3281

Description

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

Affected products

26
  • cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
    Range: <=2.6.32
  • cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
    Range: <4.0
  • cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
    Range: >=1.0.0,<3.0
  • cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:4.7:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_eus:4.7:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:5.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server:3.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_workstation:3.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
  • VMware/Esx4 versions
    cpe:2.3:o:vmware:esx:2.5.4:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:vmware:esx:2.5.4:*:*:*:*:*:*:*
    • cpe:2.3:o:vmware:esx:2.5.5:*:*:*:*:*:*:*
    • cpe:2.3:o:vmware:esx:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:o:vmware:esx:3.0.3:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

42

News mentions

0

No linked articles in our index yet.