← Vulnerability feed

Vulnerability record · CVE-2008-4225 · published 25 November 2008

CVE-2008-4225: Xmlsoft libxml vulnerability

Xmlsoft · Libxml

Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.

7.8 CVSS 2.0 High EPSS 3.2% · top 12.3% CWE-189 · CWE-189
7.8CVSS 2.0 base score
3.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
102References
16 Jun 2026Last modified by NVD

Description

Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.

AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
http://secunia.com/advisories/32762 Vendor Advisory
http://secunia.com/advisories/32764 Patch
http://secunia.com/advisories/32766 Vendor Advisory
http://secunia.com/advisories/32773 Vendor Advisory
http://secunia.com/advisories/32802 Vendor Advisory
http://secunia.com/advisories/32807 Vendor Advisory
http://secunia.com/advisories/32811 Vendor Advisory
http://secunia.com/advisories/32974
http://secunia.com/advisories/33417
http://secunia.com/advisories/33746
http://secunia.com/advisories/33792
http://secunia.com/advisories/34247
http://secunia.com/advisories/35379
http://secunia.com/advisories/36173
http://secunia.com/advisories/36235
http://security.gentoo.org/glsa/glsa-200812-06.xml
http://securitytracker.com/id?1021239
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473974
http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1
http://sunsolve.sun.com/search/document.do?assetkey=1-21-141243-01-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-251406-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-261688-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-265329-1
http://support.apple.com/kb/HT3613
http://support.apple.com/kb/HT3639
http://support.avaya.com/elmodocs2/security/ASA-2009-002.htm
http://support.avaya.com/elmodocs2/security/ASA-2009-067.htm
http://wiki.rpath.com/Advisories:rPSA-2008-0325
http://www.debian.org/security/2008/dsa-1666 Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2008:231
http://www.osvdb.org/49992
http://www.redhat.com/support/errata/RHSA-2008-0988.html
http://www.securityfocus.com/bid/32331 Patch
http://www.ubuntu.com/usn/usn-673-1
http://www.vmware.com/security/advisories/VMSA-2009-0001.html
http://www.vupen.com/english/advisories/2008/3176
http://www.vupen.com/english/advisories/2009/0034
http://www.vupen.com/english/advisories/2009/0301

Track CVE-2008-4225 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-4226Xmlsoft libxml vulnerabilityInteger overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruptio…EPSS 4.1%10.0CVE-2004-0989Xmlsoft libxml vulnerabilityMultiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code vi…EPSS 22%9.3CVE-2011-1944Xmlsoft libxml2 vulnerabilityInteger overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attacker…EPSS 13%7.5CVE-2004-0110Sgi propack vulnerabilityBuffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitr…EPSS 24%6.5CVE-2009-2416Xmlsoft libxml use after free vulnerabilityMultiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers t…EPSS 1.8%5.0CVE-2015-1819Debian linux vulnerabilityThe xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expa…EPSS 6.3%4.3CVE-2009-2414Xmlsoft libxml memory buffer overflow vulnerabilityStack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause…EPSS 3.1%8.4CVE-2013-2094Linux Kernel perf_swevent_init Integer Type Flaw Enables Local Privilege EscalationThe perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, allowing a local user to…KEVEPSS 48%analysed

Source: NIST National Vulnerability Database (record CVE-2008-4225), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.