Unscored severity · published Nov 16, 2010
CVE-2010-4008
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of…
–
CVSS
2.7%
EPSS
No
On KEV
Description
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
before 7.0.517.44 · source: NVD
IO
iOS · Apple
before 4.2 · source: NVD
DL
Debian Linux · Debian
5.0; 6.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
6.3 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
IT
Itunes · Apple
before 10.2 · source: NVD
LI
Libxml2 · Xmlsoft
before 2.7.8 · source: NVD
MO
Mac OS X · Apple
before 10.6.7 · source: NVD
OP
Openoffice · Apache
2.0.0 through 2.4.3; 3.0.0 before 3.3.0 · source: NVD
OP
Opensuse · Opensuse
11.1; 11.2; 11.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-4008
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-4008
Broken Link
http://blog.bkis.com/en/libxml2-vulnerability-in-google-chrome-and-apple-safari/
Exploit
http://code.google.com/p/chromium/issues/detail?id=58731
Vendor Advisory
http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html
Mailing List
http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
Mailing List
http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
Mailing List
http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html
More from iOS
10.0
CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
9.8
CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability
9.8
CVE-2025-31201
Apple Multiple Products Arbitrary Read and Write Vulnerability