CVE-2015-7499
No CVSS score yet. EPSS 6.4% chance of exploitation in the next 30 days. Fixed in nokogiri 1.6.7.2.
Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
- EPSS
- 6.4% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:iphone_os
- apple:mac_os_x
- apple:tvos
- apple:watchos
- canonical:ubuntu_linux
- debian:debian_linux
- hp:icewall_federation_agent
- hp:icewall_file_manager
- opensuse:leap
- opensuse:opensuse
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_hpc_node
- redhat:enterprise_linux_server
- redhat:enterprise_linux_workstation
- xmlsoft:libxml2
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jxjr-5h69-qw3w | RubyGems | nokogiri | >=1.6.0 <1.6.7.2 | 1.6.7.2 |
References
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html