Vulnerability Details CVE-2018-9251
The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 56.6%
CVSS Severity
CVSS v3 Score 5.3
CVSS v2 Score 2.6
References
Products affected by CVE-2018-9251
-
cpe:2.3:a:xmlsoft:libxml2:2.9.8
-
cpe:2.3:o:debian:debian_linux:8.0