What’s Vulnerable › Vulnerabilities

CVE-2010-4008

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2010-11-17 · updated 2026-06-16
• Weakness: CWE-119

Description

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

Affected products

• Apache Software Foundation Apache OpenOffice: from 2.0.0 through 2.4.3; from 3.0.0 before 3.3.0 — fixed in 3.3.0
• Apple Iphone Os: before 4.2 — fixed in 4.2
• Apple iTunes for Windows: before 10.2 — fixed in 10.2
• macOS: before 10.6.7 — fixed in 10.6.7
• Apple Safari: before 5.0.4 — fixed in 5.0.4
• Canonical Ubuntu Linux: 6.06, 8.04, 9.10, 10.04, 10.10
• Debian Linux: 5.0, 6.0
• Google Chrome: before 7.0.517.44 — fixed in 7.0.517.44
• Opensuse: 11.1, 11.2, 11.3
• RedHat Enterprise Linux Desktop: 6.0
• RedHat Enterprise Linux Server: 6.0
• RedHat Enterprise Linux Server Eus: 6.3
• RedHat Enterprise Linux Workstation: 6.0
• SUSE Linux Enterprise: 10-sp3, 11, 11-sp1
• xmlsoft libxml2: before 2.7.8 — fixed in 2.7.8

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OpenOffice 3.3.0; Apple Iphone Os 4.2; Apple iTunes for Windows 10.2; macOS 10.6.7; Apple Safari 5.0.4; Google Chrome 7.0.517.44; xmlsoft libxml2 2.7.8. Check the vendor advisory for mitigations.

References

• http://blog.bkis.com/en/libxml2-vulnerability-in-google-chrome-and-apple-safari/
• http://code.google.com/p/chromium/issues/detail?id=58731
• http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
• http://mail.gnome.org/archives/xml/2010-November/msg00015.html
• http://marc.info/?l=bugtraq&m=130331363227777&w=2
• http://marc.info/?l=bugtraq&m=139447903326211&w=2
• http://rhn.redhat.com/errata/RHSA-2013-0217.html

Get alerted when CVE-2010-4008 or the next vulnerability affects your stack