Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2

Metadata

medium
5.0
nokogiri
CVE-2015-7499
github.com, groups.google.com
2016-01-19
2017-06-16 19:16
ALAS-2015-628
CVE-2015-7499 libxml2
Nokogiri gem contains several vulnerabilities in libxml2
CVE-2015-7499
2017-04-01 19:10
2017-01-05 20:15

Description

Nokogiri version 1.6.7.2 has been released, pulling in several upstream
patches to the vendored libxml2 to address the following CVE:

CVE-2015-7499
CVSS v2 Base Score: 5.0 (MEDIUM)

Heap-based buffer overflow in the xmlGROW function in parser.c
in libxml2 before 2.9.3 allows context-dependent attackers to
obtain sensitive process memory information via unspecified
vectors.

libxml2 could be made to crash if it opened a specially crafted
file. It was discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked
into opening a specially crafted document, an attacker could
possibly cause libxml2 to crash, resulting in a denial of service.

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Package Patched in Unaffected in
nokogiri >= 1.6.7.2 < 1.6.0