CVE-2015-8242

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.3

Description The issue is related to the xmlSAX2TextNode function in the HTML parser of libxml2, which allows context-dependent attackers to cause a denial of service or obtain sensitive information via crafted XML data. This can lead to a stack-based buffer over-read and application crash. The vulnerability can be exploited by a remote attacker using specially formed XML data.

Recommendations For versions prior to 2.9.3, update to version 2.9.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the xmlSAX2TextNode function in the HTML parser until a patch is available. Avoid using the xmlSAX2TextNode function with untrusted XML data until the issue is resolved.