The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
La función xz_head en xzlib.c en libxml2, en versiones anteriores a la 2.9.6, permite que atacantes remotos provoquen una denegación de servicio (consumo de memoria) mediante un archivo LZMA. Esto se dene a que la funcionalidad de descifrado no restringe el uso de memoria a lo que se requiere para un archivo legítimo.
AV:N/AC:M/Au:N/C:N/I:N/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-770
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| xmlsoft | libxml2 | * | <built-in method update of dict object at 0x7fd39c4e4040> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* |