Vulnerability-Lookup

BDU:2019-00734 (CVE-2018-9251)

Vulnerability from fstec – Published: 2019-02-21 – Updated: 2025-10-24 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость функции xz_decomp библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость функции xz_decomp библиотеки libxml2 связана с неконтролируемым расходом ресурсов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании с помощью специально сформированного XML-файла

Severity

5.4 (Medium) CVSS 2.0


                      
                        AV:N/AC:H/Au:N/C:N/I:N/A:C

5.3 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource exhaustion

Incidents

Being clarified

Remediation

Software update

CWE

CWE-400 - Неконтролируемый расход ресурса («Истощение ресурса»)

Aliases

CVE-2018-9251

References

6 references

URL
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10916&cat=SIRT_1&actp=LIST
https://nvd.nist.gov/vuln/detail/CVE-2018-9251
https://bugzilla.gnome.org/show_bug.cgi?id=794914
https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html
https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e2637510…
https://поддержка.нппкт.рф/bin/view/ОСнова/Обновления/2.14/

Impacted products

5 products from 4 vendors

Vendors

Juniper Networks Inc., Сообщество свободного программного обеспечения, ООО «Ред Софт», АО «НППКТ»

Products

JunOS, libxml2, Debian GNU/Linux, РЕД ОС (запись в едином реестре российских программ №3751), ОСОН ОСнова Оnyx (запись в едином реестре российских программ №5913)

Versions

17.1r3 (JunOS), 17.2r3 (JunOS), 18.1R3 (JunOS), 18.2R2 (JunOS), от 17.1 до 17.1R2-S9 (JunOS), от 17.4 до 17.4R2 (JunOS), от 15.1 до 15.1R4-S9 (JunOS), от 16.2 до 16.2R2-S7 (JunOS), от 12.3 до 12.3R12-S10 (JunOS), 15.1R7-S2 (JunOS), от 17.2 до 17.2R1-S7 (JunOS), 16.1R7-S1 (JunOS), 17.2R2-S6 (JunOS), от 17.3 до 17.3R2-S4 (JunOS), от 15.1X53 до 15.1X53-D590 (JunOS), от 15.1X53 до 15.1X53-D234 (JunOS), от 12.1X46 до 12.1X46-D81 (JunOS), от 12.3X48 до 12.3X48-D75 (JunOS), от 14.1X53 до 14.1X53-D48 (JunOS), от 15.1F до 15.1F6-S11 (JunOS), от 15.1X49 до 15.1X49-D150 (JunOS), от 15.1X53 до 15.1X53-D495 (JunOS), от 15.1X53 до 15.1X53-D68 (JunOS), от 16.1 до 16.1R4-S11 (JunOS), 16.1R6-S5 (JunOS), 17.3R3-S1 (JunOS), от 18.1 до 18.1R2-S2 (JunOS), от 18.2 до 18.2R1-S1 (JunOS), от 18.2X75 до 18.2X75-D20 (JunOS), 2.9.8 (libxml2), 8 (Debian GNU/Linux), 7.1 МУРОМ (РЕД ОС), до 2.14 (ОСОН ОСнова Оnyx)

Product types

Operating system, Application software

Platforms

Juniper Networks Inc. JunOS 17.1r3, Juniper Networks Inc. JunOS 17.2r3, Juniper Networks Inc. JunOS 18.1R3, Juniper Networks Inc. JunOS 18.2R2, Juniper Networks Inc. JunOS от 17.1 до 17.1R2-S9, Juniper Networks Inc. JunOS от 17.4 до 17.4R2, Juniper Networks Inc. JunOS от 15.1 до 15.1R4-S9, Juniper Networks Inc. JunOS от 16.2 до 16.2R2-S7, Juniper Networks Inc. JunOS от 12.3 до 12.3R12-S10, Juniper Networks Inc. JunOS 15.1R7-S2, Juniper Networks Inc. JunOS от 17.2 до 17.2R1-S7, Juniper Networks Inc. JunOS 16.1R7-S1, Juniper Networks Inc. JunOS 17.2R2-S6, Juniper Networks Inc. JunOS от 17.3 до 17.3R2-S4, Juniper Networks Inc. JunOS от 15.1X53 до 15.1X53-D590 EX2300, Juniper Networks Inc. JunOS от 15.1X53 до 15.1X53-D590 EX3400, Juniper Networks Inc. JunOS от 15.1X53 до 15.1X53-D234 QFX5110, Juniper Networks Inc. JunOS от 15.1X53 до 15.1X53-D234 QFX5200, Juniper Networks Inc. JunOS от 12.1X46 до 12.1X46-D81 SRX, Juniper Networks Inc. JunOS от 12.3X48 до 12.3X48-D75 SRX, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 EX2200/VC, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 EX3200, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 EX3300/VC, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 EX4200, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 EX4300, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 EX4550/VC, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 EX4600, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 EX6200, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 QFX3500, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 QFX3600, Juniper Networks Inc. JunOS от 14.1X53 до 14.1X53-D48 QFX5100, Juniper Networks Inc. JunOS от 15.1F до 15.1F6-S11, Juniper Networks Inc. JunOS от 15.1X49 до 15.1X49-D150 SRX, Juniper Networks Inc. JunOS от 15.1X53 до 15.1X53-D495 NFX150, Juniper Networks Inc. JunOS от 15.1X53 до 15.1X53-D495 NFX250, Juniper Networks Inc. JunOS от 15.1X53 до 15.1X53-D68 QFX10000 Series, Juniper Networks Inc. JunOS от 16.1 до 16.1R4-S11, Juniper Networks Inc. JunOS 16.1R6-S5, Juniper Networks Inc. JunOS 17.3R3-S1, Juniper Networks Inc. JunOS от 18.1 до 18.1R2-S2, Juniper Networks Inc. JunOS от 18.2 до 18.2R1-S1, Juniper Networks Inc. JunOS от 18.2X75 до 18.2X75-D20, Сообщество свободного программного обеспечения Debian GNU/Linux 8, ООО «Ред Софт» РЕД ОС 7.1 МУРОМ (запись в едином реестре российских программ №3751), АО «НППКТ» ОСОН ОСнова Оnyx до 2.14 (запись в едином реестре российских программ №5913)

Mitigations

Использование рекомендаций: Для libxml2: https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74 Для JunOS: https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10916&cat=SIRT_1&actp=LIST Для Debian GNU/Linux: https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html Для РЕД ОС: Обновление операционной системы до версии 7.2 Обновление программного обеспечения libxml2 до версии 2.9.10+dfsg-6.7+deb11u8.osnova2u1

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:H/Au:N/C:N/I:N/A:C",
  "CVSS 3.0": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Juniper Networks Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, \u0410\u041e \u00ab\u041d\u041f\u041f\u041a\u0422\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "17.1r3 (JunOS), 17.2r3 (JunOS), 18.1R3 (JunOS), 18.2R2 (JunOS), \u043e\u0442 17.1 \u0434\u043e 17.1R2-S9 (JunOS), \u043e\u0442 17.4 \u0434\u043e 17.4R2 (JunOS), \u043e\u0442 15.1 \u0434\u043e 15.1R4-S9 (JunOS), \u043e\u0442 16.2 \u0434\u043e 16.2R2-S7 (JunOS), \u043e\u0442 12.3 \u0434\u043e 12.3R12-S10 (JunOS), 15.1R7-S2 (JunOS), \u043e\u0442 17.2 \u0434\u043e 17.2R1-S7 (JunOS), 16.1R7-S1 (JunOS), 17.2R2-S6 (JunOS), \u043e\u0442 17.3 \u0434\u043e 17.3R2-S4 (JunOS), \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D590 (JunOS), \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D234 (JunOS), \u043e\u0442 12.1X46 \u0434\u043e 12.1X46-D81 (JunOS), \u043e\u0442 12.3X48 \u0434\u043e 12.3X48-D75 (JunOS), \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 (JunOS), \u043e\u0442 15.1F \u0434\u043e 15.1F6-S11 (JunOS), \u043e\u0442 15.1X49 \u0434\u043e 15.1X49-D150 (JunOS), \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D495 (JunOS), \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D68 (JunOS), \u043e\u0442 16.1 \u0434\u043e 16.1R4-S11 (JunOS), 16.1R6-S5 (JunOS), 17.3R3-S1 (JunOS), \u043e\u0442 18.1 \u0434\u043e 18.1R2-S2 (JunOS), \u043e\u0442 18.2 \u0434\u043e 18.2R1-S1 (JunOS), \u043e\u0442 18.2X75 \u0434\u043e 18.2X75-D20 (JunOS), 2.9.8 (libxml2), 8 (Debian GNU/Linux), 7.1 \u041c\u0423\u0420\u041e\u041c (\u0420\u0415\u0414 \u041e\u0421), \u0434\u043e 2.14 (\u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f libxml2:\nhttps://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74\n\n\u0414\u043b\u044f JunOS:\n\nhttps://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10916\u0026cat=SIRT_1\u0026actp=LIST\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://lists.debian.org/debian-lts-announce/2018/09/msg00035.html\n\n\u0414\u043b\u044f \u0420\u0415\u0414 \u041e\u0421:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.2\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f libxml2 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 2.9.10+dfsg-6.7+deb11u8.osnova2u1",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "03.04.2018",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "24.10.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "21.02.2019",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2019-00734",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2018-9251",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "JunOS, libxml2, Debian GNU/Linux, \u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Juniper Networks Inc. JunOS 17.1r3 , Juniper Networks Inc. JunOS 17.2r3 , Juniper Networks Inc. JunOS 18.1R3 , Juniper Networks Inc. JunOS 18.2R2 , Juniper Networks Inc. JunOS \u043e\u0442 17.1 \u0434\u043e 17.1R2-S9 , Juniper Networks Inc. JunOS \u043e\u0442 17.4 \u0434\u043e 17.4R2 , Juniper Networks Inc. JunOS \u043e\u0442 15.1 \u0434\u043e 15.1R4-S9 , Juniper Networks Inc. JunOS \u043e\u0442 16.2 \u0434\u043e 16.2R2-S7 , Juniper Networks Inc. JunOS \u043e\u0442 12.3 \u0434\u043e 12.3R12-S10 , Juniper Networks Inc. JunOS 15.1R7-S2 , Juniper Networks Inc. JunOS \u043e\u0442 17.2 \u0434\u043e 17.2R1-S7 , Juniper Networks Inc. JunOS 16.1R7-S1 , Juniper Networks Inc. JunOS 17.2R2-S6 , Juniper Networks Inc. JunOS \u043e\u0442 17.3 \u0434\u043e 17.3R2-S4 , Juniper Networks Inc. JunOS \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D590 EX2300, Juniper Networks Inc. JunOS \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D590 EX3400, Juniper Networks Inc. JunOS \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D234 QFX5110, Juniper Networks Inc. JunOS \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D234 QFX5200, Juniper Networks Inc. JunOS \u043e\u0442 12.1X46 \u0434\u043e 12.1X46-D81 SRX, Juniper Networks Inc. JunOS \u043e\u0442 12.3X48 \u0434\u043e 12.3X48-D75 SRX, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 EX2200/VC, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 EX3200, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 EX3300/VC, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 EX4200, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 EX4300, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 EX4550/VC, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 EX6200, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 QFX3500, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 QFX3600, Juniper Networks Inc. JunOS \u043e\u0442 14.1X53 \u0434\u043e 14.1X53-D48 QFX5100, Juniper Networks Inc. JunOS \u043e\u0442 15.1F \u0434\u043e 15.1F6-S11 , Juniper Networks Inc. JunOS \u043e\u0442 15.1X49 \u0434\u043e 15.1X49-D150 SRX, Juniper Networks Inc. JunOS \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D495 NFX150, Juniper Networks Inc. JunOS \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D495 NFX250, Juniper Networks Inc. JunOS \u043e\u0442 15.1X53 \u0434\u043e 15.1X53-D68 QFX10000 Series, Juniper Networks Inc. JunOS \u043e\u0442 16.1 \u0434\u043e 16.1R4-S11 , Juniper Networks Inc. JunOS 16.1R6-S5 , Juniper Networks Inc. JunOS 17.3R3-S1 , Juniper Networks Inc. JunOS \u043e\u0442 18.1 \u0434\u043e 18.1R2-S2 , Juniper Networks Inc. JunOS \u043e\u0442 18.2 \u0434\u043e 18.2R1-S1 , Juniper Networks Inc. JunOS \u043e\u0442 18.2X75 \u0434\u043e 18.2X75-D20 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 8 , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.1 \u041c\u0423\u0420\u041e\u041c  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), \u0410\u041e \u00ab\u041d\u041f\u041f\u041a\u0422\u00bb \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx \u0434\u043e 2.14  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 xz_decomp \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libxml2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0440\u0430\u0441\u0445\u043e\u0434 \u0440\u0435\u0441\u0443\u0440\u0441\u0430 (\u00ab\u0418\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u00bb) (CWE-400)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 xz_decomp \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libxml2 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u0440\u0430\u0441\u0445\u043e\u0434\u043e\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e XML-\u0444\u0430\u0439\u043b\u0430",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10916\u0026cat=SIRT_1\u0026actp=LIST\n\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-9251\n\nhttps://bugzilla.gnome.org/show_bug.cgi?id=794914\nhttps://lists.debian.org/debian-lts-announce/2018/09/msg00035.html\nhttps://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74\nhttps://\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430.\u043d\u043f\u043f\u043a\u0442.\u0440\u0444/bin/view/\u041e\u0421\u043d\u043e\u0432\u0430/\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f/2.14/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-400",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,4)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,3)"
}

CVE-2018-9251 (GCVE-0-2018-9251)

Vulnerability from cvelistv5 – Published: 2018-04-04 02:00 – Updated: 2024-08-05 07:17

Summary

The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

2 references

URL	Tags
https://bugzilla.gnome.org/show_bug.cgi?id=794914	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST

Date Public

2018-04-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:17:51.941Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.gnome.org/show_bug.cgi?id=794914"
          },
          {
            "name": "[debian-lts-announce] 20180927 [SECURITY] [DLA 1524-1] libxml2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-04-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-28T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.gnome.org/show_bug.cgi?id=794914"
        },
        {
          "name": "[debian-lts-announce] 20180927 [SECURITY] [DLA 1524-1] libxml2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-9251",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.gnome.org/show_bug.cgi?id=794914",
              "refsource": "MISC",
              "url": "https://bugzilla.gnome.org/show_bug.cgi?id=794914"
            },
            {
              "name": "[debian-lts-announce] 20180927 [SECURITY] [DLA 1524-1] libxml2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-9251",
    "datePublished": "2018-04-04T02:00:00.000Z",
    "dateReserved": "2018-04-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:17:51.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2019-00734 (CVE-2018-9251)

CVE-2018-9251 (GCVE-0-2018-9251)

Tags

Sightings

Nomenclature

Related by attack behaviour