PublicDateAtUSN: 2016-04-13 Candidate: CVE-2015-8806 PublicDate: 2016-04-13 17:59:00 UTC References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8806 https://ubuntu.com/security/notices/USN-2994-1 Description: dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the " This is a dupe of CVE-2016-1839 Bugs: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813613 https://bugzilla.gnome.org/show_bug.cgi?id=749115 Priority: low Discovered-by: Assigned-to: mdeslaur CVSS: nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH] nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH] Patches_libxml2: upstream_libxml2: needs-triage precise_libxml2: released (2.7.8.dfsg-5.1ubuntu4.15) precise/esm_libxml2: released (2.7.8.dfsg-5.1ubuntu4.15) trusty_libxml2: released (2.9.1+dfsg1-3ubuntu4.8) trusty/esm_libxml2: released (2.9.1+dfsg1-3ubuntu4.8) vivid/stable-phone-overlay_libxml2: ignored (reached end-of-life) vivid/ubuntu-core_libxml2: DNE wily_libxml2: released (2.9.2+zdfsg1-4ubuntu0.4) xenial_libxml2: released (2.9.3+dfsg1-1ubuntu0.1) esm-infra/xenial_libxml2: released (2.9.3+dfsg1-1ubuntu0.1) yakkety_libxml2: not-affected (2.9.3+dfsg1-1.2) zesty_libxml2: not-affected (2.9.3+dfsg1-1.2) devel_libxml2: not-affected (2.9.3+dfsg1-1.2)