Sha256: 5547fc46d8a8a5734b798f0a7cd877ba4ab99d76836734f16145c7f4fea91a2f
Contents?: true
Size: 1.13 KB
Versions: 6
Compression:
Stored size: 1.13 KB
Contents
---
gem: nokogiri
cve: 2015-7499
url: https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
title: |
Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2
date: 2016-01-19
description: |
Nokogiri version 1.6.7.2 has been released, pulling in several upstream
patches to the vendored libxml2 to address the following CVE:
CVE-2015-7499
CVSS v2 Base Score: 5.0 (MEDIUM)
Heap-based buffer overflow in the xmlGROW function in parser.c
in libxml2 before 2.9.3 allows context-dependent attackers to
obtain sensitive process memory information via unspecified
vectors.
libxml2 could be made to crash if it opened a specially crafted
file. It was discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked
into opening a specially crafted document, an attacker could
possibly cause libxml2 to crash, resulting in a denial of service.
cvss_v2: 5.0
unaffected_versions:
- "< 1.6.0"
patched_versions:
- ">= 1.6.7.2"
related:
url:
- https://github.com/sparklemotion/nokogiri/commit/9eb540e7c905924a42757bf0a34c2c00707d536c
Version data entries
6 entries across 6 versions & 2 rubygems