NVD Vulnerability Detail

CVE-2012-2871

Summary	libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.
Publication Date	Sept. 1, 2012, 4:55 a.m.
Registration Date	Jan. 28, 2021, 2:59 p.m.
Last Update	Nov. 21, 2024, 10:39 a.m.

CVSS2.0 : MEDIUM
Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:apple:iphone_os:6.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os:3.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.0.2:::::::*
cpe:2.3:o:apple:iphone_os:4.3.2:::::::*
cpe:2.3:o:apple:iphone_os:4.0.2:::::::*
cpe:2.3:o:apple:iphone_os::::::::		6.1.4
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.1:::::::*
cpe:2.3:o:apple:iphone_os:6.1.3:::::::*
cpe:2.3:o:apple:iphone_os:5.1:::::::*
cpe:2.3:o:apple:iphone_os:4.2.8:::::::*
cpe:2.3:o:apple:iphone_os:6.0.2:::::::*
cpe:2.3:o:apple:iphone_os:4.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:3.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.0.1:::::::*
cpe:2.3:o:apple:iphone_os:4.3.1:::::::*
cpe:2.3:o:apple:iphone_os:4.2.5:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.1.0:::::::*
cpe:2.3:o:apple:iphone_os:1.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:6.0:::::::*
cpe:2.3:o:apple:iphone_os:4.3.5:::::::*
cpe:2.3:o:apple:iphone_os:6.1:::::::*
cpe:2.3:o:apple:iphone_os:4.2.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.5:::::::*
cpe:2.3:o:apple:iphone_os:4.0.1:::::::*
cpe:2.3:o:apple:iphone_os:4.3.3:::::::*
cpe:2.3:o:apple:iphone_os:5.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.4:::::::*
cpe:2.3:o:apple:iphone_os:5.0:::::::*
cpe:2.3:o:apple:iphone_os:1.0.0:::::::*
cpe:2.3:o:apple:iphone_os:5.1.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:4.0:::::::*
cpe:2.3:o:apple:iphone_os:4.3.0:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.2.2:::::::*
cpe:2.3:o:apple:iphone_os:6.0.1:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:google:chrome:21.0.1180.62:::::::*
cpe:2.3:a:google:chrome:21.0.1180.82:::::::*
cpe:2.3:a:google:chrome:21.0.1180.73:::::::*
cpe:2.3:a:google:chrome:21.0.1180.77:::::::*
cpe:2.3:a:xmlsoft:libxml2::rc1::::::*		2.9.0
cpe:2.3:a:google:chrome:21.0.1180.46:::::::*
cpe:2.3:a:google:chrome:21.0.1180.1:::::::*
cpe:2.3:a:google:chrome:21.0.1180.76:::::::*
cpe:2.3:a:google:chrome:21.0.1180.61:::::::*
cpe:2.3:a:google:chrome:21.0.1180.79:::::::*
cpe:2.3:a:google:chrome:21.0.1180.55:::::::*
cpe:2.3:a:google:chrome:21.0.1180.71:::::::*
cpe:2.3:a:google:chrome:21.0.1180.78:::::::*
cpe:2.3:a:google:chrome:21.0.1180.31:::::::*
cpe:2.3:a:google:chrome:21.0.1180.37:::::::*
cpe:2.3:a:google:chrome:21.0.1180.49:::::::*
cpe:2.3:a:google:chrome:21.0.1180.33:::::::*
cpe:2.3:a:google:chrome:21.0.1180.87:::::::*
cpe:2.3:a:google:chrome:21.0.1180.52:::::::*
cpe:2.3:a:google:chrome:21.0.1180.38:::::::*
cpe:2.3:a:google:chrome:21.0.1180.0:::::::*
cpe:2.3:a:google:chrome:21.0.1180.57:::::::*
cpe:2.3:a:google:chrome:21.0.1180.85:::::::*
cpe:2.3:a:google:chrome:21.0.1180.2:::::::*
cpe:2.3:a:google:chrome:21.0.1180.56:::::::*
cpe:2.3:a:google:chrome::::::::		21.0.1180.88
cpe:2.3:a:google:chrome:21.0.1180.50:::::::*
cpe:2.3:a:google:chrome:21.0.1180.83:::::::*
cpe:2.3:a:google:chrome:21.0.1180.64:::::::*
cpe:2.3:a:google:chrome:21.0.1180.60:::::::*
cpe:2.3:a:google:chrome:21.0.1180.32:::::::*
cpe:2.3:a:google:chrome:21.0.1180.84:::::::*
cpe:2.3:a:google:chrome:21.0.1180.48:::::::*
cpe:2.3:a:google:chrome:21.0.1180.70:::::::*
cpe:2.3:a:google:chrome:21.0.1180.74:::::::*
cpe:2.3:a:google:chrome:21.0.1180.51:::::::*
cpe:2.3:a:google:chrome:21.0.1180.41:::::::*
cpe:2.3:a:google:chrome:21.0.1180.35:::::::*
cpe:2.3:a:google:chrome:21.0.1180.72:::::::*
cpe:2.3:a:google:chrome:21.0.1180.36:::::::*
cpe:2.3:a:google:chrome:21.0.1180.39:::::::*
cpe:2.3:a:google:chrome:21.0.1180.59:::::::*
cpe:2.3:a:google:chrome:21.0.1180.53:::::::*
cpe:2.3:a:google:chrome:21.0.1180.75:::::::*
cpe:2.3:a:google:chrome:21.0.1180.68:::::::*
cpe:2.3:a:google:chrome:21.0.1180.47:::::::*
cpe:2.3:a:google:chrome:21.0.1180.63:::::::*
cpe:2.3:a:google:chrome:21.0.1180.54:::::::*
cpe:2.3:a:google:chrome:21.0.1180.86:::::::*
cpe:2.3:a:google:chrome:21.0.1180.34:::::::*
cpe:2.3:a:google:chrome:21.0.1180.80:::::::*
cpe:2.3:a:google:chrome:21.0.1180.81:::::::*
cpe:2.3:a:google:chrome:21.0.1180.69:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://code.google.com/p/chromium/issues/detail?id=138673
2	http://code.google.com/p/chromium/issues/detail?id=138673
3	http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html
4	http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html
5	http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
6	http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
7	http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
8	http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
9	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html
10	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html
11	http://secunia.com/advisories/50838
12	http://secunia.com/advisories/50838
13	http://secunia.com/advisories/54886
14	http://secunia.com/advisories/54886
15	http://src.chromium.org/viewvc/chrome/trunk/src/third_party/libxml/src/include/libxml/tree.h?r1=56276&r2=149930
16	http://src.chromium.org/viewvc/chrome/trunk/src/third_party/libxml/src/include/libxml/tree.h?r1=56276&r2=149930
17	http://src.chromium.org/viewvc/chrome/trunk/src/third_party/libxml/src/include/libxml/tree.h?view=log
18	http://src.chromium.org/viewvc/chrome/trunk/src/third_party/libxml/src/include/libxml/tree.h?view=log
19	http://support.apple.com/kb/HT5934
20	http://support.apple.com/kb/HT5934
21	http://support.apple.com/kb/HT6001
22	http://support.apple.com/kb/HT6001
23	http://www.debian.org/security/2012/dsa-2555
24	http://www.debian.org/security/2012/dsa-2555
25	http://www.mandriva.com/security/advisories?name=MDVSA-2012:164
26	http://www.mandriva.com/security/advisories?name=MDVSA-2012:164
27	https://chromiumcodereview.appspot.com/10824157
28	https://chromiumcodereview.appspot.com/10824157
29	https://exchange.xforce.ibmcloud.com/vulnerabilities/78179
30	https://exchange.xforce.ibmcloud.com/vulnerabilities/78179

Common Vulnerabilities List

JVN Vulnerability Information

Google Chrome で使用される libxml2 におけるサービス運用妨害 (DoS) の脆弱性

Title	Google Chrome で使用される libxml2 におけるサービス運用妨害 (DoS) の脆弱性
Summary	Google Chrome で使用される libxml2 は、XSL 変換処理の間、不特定の変数のキャストを適切にサポートしないため、サービス運用妨害 (DoS) 状態となるなど、不特定の影響を受ける脆弱性が存在します。
Possible impacts	第三者により、include/libxml/tree.h の _xmlNs データ構造に関連する巧妙に細工されたドキュメントを介して、サービス運用妨害 (DoS) 状態にされるなど、不特定の影響を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 30, 2012, midnight
Registration Date	Sept. 4, 2012, 3:45 p.m.
Last Update	Feb. 3, 2014, 11:20 a.m.

Affected System

アップル

Apple TV 6.0 未満 (Apple TV 第 2 世代以降)

iOS 7 未満 (iPad 2 以降)

iOS 7 未満 (iPhone 4 以降)

iOS 7 未満 (iPod touch 第 5 世代以降)

iTunes 11.1.4 未満 (Windows 7)

iTunes 11.1.4 未満 (Windows 8)

iTunes 11.1.4 未満 (Windows Vista)

iTunes 11.1.4 未満 (Windows XP SP2 以降)

Google

Google Chrome 21.0.1180.89 未満

xmlsoft.org

libxml2 2.9.0-rc1 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-2871	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2871
National Vulnerability Database (NVD)
2	CVE-2012-2871	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2871

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
Apple Mailing Lists
1	APPLE-SA-2013-09-18-2	http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
2	APPLE-SA-2013-09-20-1	http://lists.apple.com/archives/security-announce/2013/Sep/msg00008.html
3	APPLE-SA-2013-10-22-8	http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
Apple Security Updates
4	HT5934	http://support.apple.com/kb/HT5934
5	HT5935	http://support.apple.com/kb/HT5935
6	HT6001	http://support.apple.com/kb/HT6001
Apple セキュリティアップデート
7	HT5934	http://support.apple.com/kb/HT5934?viewlocale=ja_JP
8	HT5935	http://support.apple.com/kb/HT5935?viewlocale=ja_JP
9	HT6001	http://support.apple.com/kb/HT6001?viewlocale=ja_JP
Chromium
10	Diff of /trunk/src/third_party/libxml/src/include/libxml/tree.h	http://src.chromium.org/viewvc/chrome/trunk/src/third_party/libxml/src/include/libxml/tree.h?r1=56276&r2=149930
11	Log of /trunk/src/third_party/libxml/src/include/libxml/tree.h	http://src.chromium.org/viewvc/chrome/trunk/src/third_party/libxml/src/include/libxml/tree.h?view=log
Chromium Code Reviews
12	Issue 10824157: Fix namespace vs. node type issue in a generic way.	https://chromiumcodereview.appspot.com/10824157
Debian Security Advisory
13	DSA-2555	http://www.debian.org/security/2012/dsa-2555
Google
14	Google Chrome	http://www.google.co.jp/chrome/intl/ja/landing_ff_yt.html?hl=ja&hl=ja
15	Stable Channel Update	http://googlechromereleases.blogspot.jp/2012/08/stable-channel-update_30.html
opensuse-security-announce
16	openSUSE-SU-2012:1215	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html
Security Advisories
17	MDVSA-2012:164	http://www.mandriva.com/security/advisories?name=MDVSA-2012:164
SECURITY BLOG
18	Multiple vulnerabilities in libxslt	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_libxslt
xmlsoft.org
19	Top Page	http://www.xmlsoft.org/

その他

No	Name	URL
JVN
1	JVNVU#94321146	http://jvn.jp/vu/JVNVU94321146/
2	JVNVU#95174988	http://jvn.jp/cert/JVNVU95174988/
3	JVNVU#98681940	http://jvn.jp/cert/JVNVU98681940/index.html

Change Log

No	Changed Details	Date of change
0	[2012年09月04日] 掲載 [2012年10月22日] ベンダ情報：Debian (DSA-2555) を追加 [2012年11月05日] ベンダ情報：Novell (openSUSE-SU-2012:1215) を追加 [2013年03月07日] ベンダ情報：オラクル (Multiple vulnerabilities in libxslt) を追加 [2013年10月15日] 影響を受けるシステム：アップル (HT5934) の情報を追加影響を受けるシステム：アップル (HT5935) の情報を追加ベンダ情報：アップル (HT5934) を追加ベンダ情報：アップル (HT5935) を追加ベンダ情報：アップル (APPLE-SA-2013-09-18-2) を追加参考情報：JVN (JVNVU#98681940) を追加 [2013年11月08日] 影響を受けるシステム：アップル (HT6001) の情報を追加ベンダ情報：Mandriva, Inc. (MDVSA-2012:164) を追加ベンダ情報：アップル (APPLE-SA-2013-10-22-8) を追加ベンダ情報：アップル (APPLE-SA-2013-09-20-1) を追加ベンダ情報：アップル (HT6001) を追加参考情報：JVN (JVNVU#95174988) を追加 [2014年02月03日] 影響を受けるシステム：内容を更新参考情報：JVN (JVNVU#94321146) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:apple:iphone_os:6.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os:3.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.0.2:::::::*
cpe:2.3:o:apple:iphone_os:4.3.2:::::::*
cpe:2.3:o:apple:iphone_os:4.0.2:::::::*
cpe:2.3:o:apple:iphone_os::::::::		6.1.4
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.1:::::::*
cpe:2.3:o:apple:iphone_os:6.1.3:::::::*
cpe:2.3:o:apple:iphone_os:5.1:::::::*
cpe:2.3:o:apple:iphone_os:4.2.8:::::::*
cpe:2.3:o:apple:iphone_os:6.0.2:::::::*
cpe:2.3:o:apple:iphone_os:4.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:3.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.0.1:::::::*
cpe:2.3:o:apple:iphone_os:4.3.1:::::::*
cpe:2.3:o:apple:iphone_os:4.2.5:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.1.0:::::::*
cpe:2.3:o:apple:iphone_os:1.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:6.0:::::::*
cpe:2.3:o:apple:iphone_os:4.3.5:::::::*
cpe:2.3:o:apple:iphone_os:6.1:::::::*
cpe:2.3:o:apple:iphone_os:4.2.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.5:::::::*
cpe:2.3:o:apple:iphone_os:4.0.1:::::::*
cpe:2.3:o:apple:iphone_os:4.3.3:::::::*
cpe:2.3:o:apple:iphone_os:5.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.4:::::::*
cpe:2.3:o:apple:iphone_os:5.0:::::::*
cpe:2.3:o:apple:iphone_os:1.0.0:::::::*
cpe:2.3:o:apple:iphone_os:5.1.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:4.0:::::::*
cpe:2.3:o:apple:iphone_os:4.3.0:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.2.2:::::::*
cpe:2.3:o:apple:iphone_os:6.0.1:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:google:chrome:21.0.1180.62:::::::*
cpe:2.3:a:google:chrome:21.0.1180.82:::::::*
cpe:2.3:a:google:chrome:21.0.1180.73:::::::*
cpe:2.3:a:google:chrome:21.0.1180.77:::::::*
cpe:2.3:a:xmlsoft:libxml2::rc1::::::*		2.9.0
cpe:2.3:a:google:chrome:21.0.1180.46:::::::*
cpe:2.3:a:google:chrome:21.0.1180.1:::::::*
cpe:2.3:a:google:chrome:21.0.1180.76:::::::*
cpe:2.3:a:google:chrome:21.0.1180.61:::::::*
cpe:2.3:a:google:chrome:21.0.1180.79:::::::*
cpe:2.3:a:google:chrome:21.0.1180.55:::::::*
cpe:2.3:a:google:chrome:21.0.1180.71:::::::*
cpe:2.3:a:google:chrome:21.0.1180.78:::::::*
cpe:2.3:a:google:chrome:21.0.1180.31:::::::*
cpe:2.3:a:google:chrome:21.0.1180.37:::::::*
cpe:2.3:a:google:chrome:21.0.1180.49:::::::*
cpe:2.3:a:google:chrome:21.0.1180.33:::::::*
cpe:2.3:a:google:chrome:21.0.1180.87:::::::*
cpe:2.3:a:google:chrome:21.0.1180.52:::::::*
cpe:2.3:a:google:chrome:21.0.1180.38:::::::*
cpe:2.3:a:google:chrome:21.0.1180.0:::::::*
cpe:2.3:a:google:chrome:21.0.1180.57:::::::*
cpe:2.3:a:google:chrome:21.0.1180.85:::::::*
cpe:2.3:a:google:chrome:21.0.1180.2:::::::*
cpe:2.3:a:google:chrome:21.0.1180.56:::::::*
cpe:2.3:a:google:chrome::::::::		21.0.1180.88
cpe:2.3:a:google:chrome:21.0.1180.50:::::::*
cpe:2.3:a:google:chrome:21.0.1180.83:::::::*
cpe:2.3:a:google:chrome:21.0.1180.64:::::::*
cpe:2.3:a:google:chrome:21.0.1180.60:::::::*
cpe:2.3:a:google:chrome:21.0.1180.32:::::::*
cpe:2.3:a:google:chrome:21.0.1180.84:::::::*
cpe:2.3:a:google:chrome:21.0.1180.48:::::::*
cpe:2.3:a:google:chrome:21.0.1180.70:::::::*
cpe:2.3:a:google:chrome:21.0.1180.74:::::::*
cpe:2.3:a:google:chrome:21.0.1180.51:::::::*
cpe:2.3:a:google:chrome:21.0.1180.41:::::::*
cpe:2.3:a:google:chrome:21.0.1180.35:::::::*
cpe:2.3:a:google:chrome:21.0.1180.72:::::::*
cpe:2.3:a:google:chrome:21.0.1180.36:::::::*
cpe:2.3:a:google:chrome:21.0.1180.39:::::::*
cpe:2.3:a:google:chrome:21.0.1180.59:::::::*
cpe:2.3:a:google:chrome:21.0.1180.53:::::::*
cpe:2.3:a:google:chrome:21.0.1180.75:::::::*
cpe:2.3:a:google:chrome:21.0.1180.68:::::::*
cpe:2.3:a:google:chrome:21.0.1180.47:::::::*
cpe:2.3:a:google:chrome:21.0.1180.63:::::::*
cpe:2.3:a:google:chrome:21.0.1180.54:::::::*
cpe:2.3:a:google:chrome:21.0.1180.86:::::::*
cpe:2.3:a:google:chrome:21.0.1180.34:::::::*
cpe:2.3:a:google:chrome:21.0.1180.80:::::::*
cpe:2.3:a:google:chrome:21.0.1180.81:::::::*
cpe:2.3:a:google:chrome:21.0.1180.69:::::::*