NVD Vulnerability Detail

CVE-2015-1819

Summary	The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
Publication Date	Aug. 15, 2015, 3:59 a.m.
Registration Date	Jan. 26, 2021, 2:46 p.m.
Last Update	Nov. 21, 2024, 11:26 a.m.

CVSS2.0 : MEDIUM
Score	5.0
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:7.0:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux::::::::			5.0

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:xmlsoft:libxml::::::::

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:oracle:solaris:11.3:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:o:apple:watchos::::::::		2.1
cpe:2.3:o:apple:iphone_os::::::::		9.2.1
cpe:2.3:o:apple:mac_os_x::::::::		10.11.3
cpe:2.3:o:apple:tvos::::::::		9.1

Configuration7		or higher	or less	more than	less than
cpe:2.3:o:oracle:linux:7:::::::*

Configuration8	or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:13.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*

Configuration9	or higher	or less	more than	less than
cpe:2.3:o:fedoraproject:fedora:22:::::::*
cpe:2.3:o:fedoraproject:fedora:23:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html	Mailing List Third Party Advisory
2	http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html	Mailing List Third Party Advisory
3	http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html	Mailing List Third Party Advisory
4	http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html	Mailing List Third Party Advisory
5	http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html	Mailing List Third Party Advisory
6	http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html	Mailing List Third Party Advisory
7	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	Mailing List Third Party Advisory
8	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	Mailing List Third Party Advisory
9	http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172710.html	Third Party Advisory
10	http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172710.html	Third Party Advisory
11	http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172943.html	Third Party Advisory
12	http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172943.html	Third Party Advisory
13	http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html	Third Party Advisory
14	http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html	Third Party Advisory
15	http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html	Third Party Advisory
16	http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html	Third Party Advisory
17	http://rhn.redhat.com/errata/RHSA-2015-1419.html	Third Party Advisory
18	http://rhn.redhat.com/errata/RHSA-2015-1419.html	Third Party Advisory
19	http://rhn.redhat.com/errata/RHSA-2015-2550.html	Third Party Advisory
20	http://rhn.redhat.com/errata/RHSA-2015-2550.html	Third Party Advisory
21	http://www.debian.org/security/2015/dsa-3430	Third Party Advisory
22	http://www.debian.org/security/2015/dsa-3430	Third Party Advisory
23	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
24	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
25	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	Third Party Advisory
26	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	Third Party Advisory
27	http://www.securityfocus.com/bid/75570	Third Party Advisory VDB Entry
28	http://www.securityfocus.com/bid/75570	Third Party Advisory VDB Entry
29	http://www.securitytracker.com/id/1034243	Third Party Advisory VDB Entry
30	http://www.securitytracker.com/id/1034243	Third Party Advisory VDB Entry
31	http://www.ubuntu.com/usn/USN-2812-1	Third Party Advisory
32	http://www.ubuntu.com/usn/USN-2812-1	Third Party Advisory
33	http://xmlsoft.org/news.html	Third Party Advisory
34	http://xmlsoft.org/news.html	Third Party Advisory
35	https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9	Patch Vendor Advisory
36	https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9	Patch Vendor Advisory
37	https://security.gentoo.org/glsa/201507-08	Third Party Advisory
38	https://security.gentoo.org/glsa/201507-08	Third Party Advisory
39	https://security.gentoo.org/glsa/201701-37	Third Party Advisory
40	https://security.gentoo.org/glsa/201701-37	Third Party Advisory
41	https://support.apple.com/HT206166	Third Party Advisory
42	https://support.apple.com/HT206166	Third Party Advisory
43	https://support.apple.com/HT206167	Third Party Advisory
44	https://support.apple.com/HT206167	Third Party Advisory
45	https://support.apple.com/HT206168	Third Party Advisory
46	https://support.apple.com/HT206168	Third Party Advisory
47	https://support.apple.com/HT206169	Third Party Advisory
48	https://support.apple.com/HT206169	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-399	リソース管理の問題	https://cwe.mitre.org/data/definitions/399.html

JVN Vulnerability Information

libxml2 の xmlreader におけるサービス運用妨害 (DoS) の脆弱性

Title	libxml2 の xmlreader におけるサービス運用妨害 (DoS) の脆弱性
Summary	libxml2 の xmlreader には、XML エンティティ拡張 (XEE) 攻撃に関する処理に不備があるため、サービス運用妨害 (メモリ消費) 状態にされる脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された XML データを介して、サービス運用妨害 (メモリ消費) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 14, 2015, midnight
Registration Date	Aug. 18, 2015, 3:15 p.m.
Last Update	March 29, 2016, 3:41 p.m.

Affected System

アップル

Apple Mac OS X 10.10.5

Apple Mac OS X 10.11 から 10.11.3

Apple Mac OS X 10.9.5

iOS 9.3 未満 (iPad 2 以降)

iOS 9.3 未満 (iPhone 4s 以降)

iOS 9.3 未満 (iPod touch 第 5 世代以降)

tvOS 9.2 未満 (Apple TV 第 4 世代)

watchOS 2.2 未満 (Apple Watch Edition)

watchOS 2.2 未満 (Apple Watch Hermes)

watchOS 2.2 未満 (Apple Watch Sport)

watchOS 2.2 未満 (Apple Watch)

日立

Job Management Partner 1/IT Desktop Management - Manager

Job Management Partner 1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management - Manager

JP1/IT Desktop Management 2 - Manager

JP1/IT Desktop Management 2 - Operations Director

xmlsoft.org

libxml2

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-1819	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819
GNOME GIT REPOSITORY
2	CVE-2015-1819 Enforce the reader to run in constant memory	https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9
National Vulnerability Database (NVD)
3	CVE-2015-1819	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1819

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
Apple Mailing Lists
1	APPLE-SA-2016-03-21-1 iOS 9.3	http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
2	APPLE-SA-2016-03-21-2 watchOS 2.2	http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
3	APPLE-SA-2016-03-21-3 tvOS 9.2	http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
4	APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
Apple Security Updates
5	HT206166	https://support.apple.com/en-us/HT206166
6	HT206167	https://support.apple.com/en-us/HT206167
7	HT206168	https://support.apple.com/en-us/HT206168
8	HT206169	https://support.apple.com/en-us/HT206169
Apple セキュリティアップデート
9	HT206166	https://support.apple.com/ja-jp/HT206166
10	HT206167	https://support.apple.com/ja-jp/HT206167
11	HT206168	https://support.apple.com/ja-jp/HT206168
12	HT206169	https://support.apple.com/ja-jp/HT206169
Hitachi Software Vulnerability Information
13	hitachi-sec-2025-122	https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-122/index.html
Oracle Technology Network
14	Oracle Solaris Third Party Bulletin - October 2015	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
Red Hat Security Advisory
15	RHSA-2015:1419	https://rhn.redhat.com/errata/RHSA-2015-1419.html
16	RHSA-2015:2550	https://rhn.redhat.com/errata/RHSA-2015-2550.html
xmlsoft.org news
17	v2.9.3: Nov 20 2015	http://xmlsoft.org/news.html
ソフトウェア製品セキュリティ情報
18	hitachi-sec-2025-122	https://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2025-122/index.html

その他

No	Name	URL
JVN
1	JVNVU#97668313	http://jvn.jp/vu/JVNVU97668313/index.html

Change Log

No	Changed Details	Date of change
0	[2015年08月18日] 掲載 [2015年10月30日] ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - October 2015) を追加 [2015年12月22日] ベンダ情報：xmlsoft.org (v2.9.3: Nov 20 2015) を追加ベンダ情報：レッドハット (RHSA-2015:2550) を追加 [2016年03月29日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (HT206166) を追加ベンダ情報：アップル (HT206167) を追加ベンダ情報：アップル (HT206168) を追加ベンダ情報：アップル (HT206169) を追加ベンダ情報：アップル (APPLE-SA-2016-03-21-1 iOS 9.3) を追加ベンダ情報：アップル (APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002) を追加ベンダ情報：アップル (APPLE-SA-2016-03-21-2 watchOS 2.2) を追加ベンダ情報：アップル (APPLE-SA-2016-03-21-3 tvOS 9.2) を追加参考情報：JVN (JVNVU#97668313) を追加	Feb. 17, 2018, 10:37 a.m.
1	[2025年05月16日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：日立 (hitachi-sec-2025-122) を追加	May 16, 2025, 3:57 p.m.