CVE-2015-7941

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.2

Description The issue is caused by improper handling of invalid input, allowing context-dependent attackers to cause a denial of service via crafted XML data. This can lead to an out-of-bounds read and a crash in libxml2. The xmlParseEntityDecl and xmlParseConditionalSections functions in parser.c are affected.

Recommendations For libxml2 version 2.9.2, consider updating to a newer version to resolve the issue. As a temporary workaround, restrict the use of the xmlParseEntityDecl and xmlParseConditionalSections functions in parser.c to minimize the risk of exploitation. Avoid using crafted XML data that could trigger the denial of service.