CVE catalog

CVE-2015-8806

libxml2: CVE-2015-8806

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
4.96% · Oct 25, 2026

dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxml2sid2.15.4+dfsg-1fixed
Debianlibxml2forky2.15.4+dfsg-1fixed
Debianlibxml2trixie2.12.7+dfsg+really2.9.14-2.1+deb13u3fixed
Debianlibxml2trixie-security2.12.7+dfsg+really2.9.14-2.1+deb13u1fixed
Debianlibxml2bookworm2.9.14+dfsg-1.3~deb12u6fixed
Debianlibxml2bookworm-security2.9.14+dfsg-1.3~deb12u4fixed
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu2vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu3vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.1vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.2vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.3vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.4vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.5vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.6vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.7vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.8fixed
Ubuntulibxml216.042.9.2+zdfsg1-4vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu1vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu2vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu3vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.1fixed
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu2vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu3vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.1vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.2vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.3vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.4vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.5vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.6vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.7vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.8fixed
Ubuntulibxml216.042.9.2+zdfsg1-4vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu1vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu2vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu3vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.1fixed
Suselibxml2linux enterprise desktop 122.9.1-24.1fixed
Susepython-libxml2linux enterprise desktop 122.9.1-24.1fixed
Suselibxml2linux enterprise desktop 12 sp12.9.1-24.1fixed
Susepython-libxml2linux enterprise desktop 12 sp12.9.1-24.1fixed
Suselibxml2linux enterprise software development kit 122.9.1-24.1fixed
Suselibxml2linux enterprise software development kit 12 sp12.9.1-24.1fixed
Suselibxml2linux enterprise server 122.9.1-24.1fixed
Susepython-libxml2linux enterprise server 122.9.1-24.1fixed
Suselibxml2linux enterprise server for sap applications 122.9.1-24.1fixed
Susepython-libxml2linux enterprise server for sap applications 122.9.1-24.1fixed
Suselibxml2linux enterprise server 12 sp12.9.1-24.1fixed
Susepython-libxml2linux enterprise server 12 sp12.9.1-24.1fixed
Suselibxml2linux enterprise server for sap applications 12 sp12.9.1-24.1fixed
Susepython-libxml2linux enterprise server for sap applications 12 sp12.9.1-24.1fixed
Suselibxml2linux enterprise software development kit 11 sp42.7.6-0.44.1fixed
Suselibxml2openstack cloud 52.7.6-0.44.1fixed
Suselibxml2-pythonopenstack cloud 52.7.6-0.44.4fixed
Suselibxml2manager 2.12.7.6-0.44.1fixed
Suselibxml2-pythonmanager 2.12.7.6-0.44.4fixed
Suselibxml2manager proxy 2.12.7.6-0.44.1fixed
Suselibxml2-pythonmanager proxy 2.12.7.6-0.44.4fixed
Suselibxml2linux enterprise server 11 sp2-ltss2.7.6-0.44.1fixed
Suselibxml2-pythonlinux enterprise server 11 sp2-ltss2.7.6-0.44.4fixed
Suselibxml2linux enterprise server 11 sp3-ltss2.7.6-0.44.1fixed
Suselibxml2-pythonlinux enterprise server 11 sp3-ltss2.7.6-0.44.4fixed
Suselibxml2linux enterprise server 11 sp3-teradata2.7.6-0.44.1fixed
Suselibxml2-pythonlinux enterprise server 11 sp3-teradata2.7.6-0.44.4fixed
Suselibxml2linux enterprise server 11 sp42.7.6-0.44.1fixed
Suselibxml2-pythonlinux enterprise server 11 sp42.7.6-0.44.4fixed
Suselibxml2linux enterprise server for sap applications 11 sp42.7.6-0.44.1fixed
Suselibxml2-pythonlinux enterprise server for sap applications 11 sp42.7.6-0.44.4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxml2sourcesid2.9.3+dfsg1-1.1not yet assignedNot reported[813613]
Debianlibxml2sourceforky2.9.3+dfsg1-1.1not yet assignedNot reported[813613]
Debianlibxml2sourcetrixie2.9.3+dfsg1-1.1not yet assignedNot reported[813613]
Debianlibxml2sourcebookworm2.9.3+dfsg1-1.1not yet assignedNot reported[813613]
Ubuntulibxml2deb14.042.9.1+dfsg1-3ubuntu4.8Not reportedUBUNTU-CVE-2015-8806Not reported
Ubuntulibxml2deb16.042.9.3+dfsg1-1ubuntu0.1Not reportedUBUNTU-CVE-2015-8806Not reported
Ubuntulibxml2deb14.042.9.1+dfsg1-3ubuntu4.8Not reportedUSN-2994-1Not reported
Ubuntulibxml2deb16.042.9.3+dfsg1-1ubuntu0.1Not reportedUSN-2994-1Not reported
Suselibxml2rpmlinux enterprise desktop 122.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Susepython-libxml2rpmlinux enterprise desktop 122.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Suselibxml2rpmlinux enterprise desktop 12 sp12.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Susepython-libxml2rpmlinux enterprise desktop 12 sp12.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Suselibxml2rpmlinux enterprise software development kit 122.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Suselibxml2rpmlinux enterprise software development kit 12 sp12.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Suselibxml2rpmlinux enterprise server 122.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Susepython-libxml2rpmlinux enterprise server 122.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 122.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Susepython-libxml2rpmlinux enterprise server for sap applications 122.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp12.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp12.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 12 sp12.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Susepython-libxml2rpmlinux enterprise server for sap applications 12 sp12.9.1-24.1Not reportedSUSE-SU-2016:1538-1Not reported
Suselibxml2rpmlinux enterprise software development kit 11 sp42.7.6-0.44.1Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2rpmopenstack cloud 52.7.6-0.44.1Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2-pythonrpmopenstack cloud 52.7.6-0.44.4Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2rpmmanager 2.12.7.6-0.44.1Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2-pythonrpmmanager 2.12.7.6-0.44.4Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2rpmmanager proxy 2.12.7.6-0.44.1Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2-pythonrpmmanager proxy 2.12.7.6-0.44.4Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2rpmlinux enterprise server 11 sp2-ltss2.7.6-0.44.1Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 11 sp2-ltss2.7.6-0.44.4Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2rpmlinux enterprise server 11 sp3-ltss2.7.6-0.44.1Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 11 sp3-ltss2.7.6-0.44.4Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2rpmlinux enterprise server 11 sp3-teradata2.7.6-0.44.1Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 11 sp3-teradata2.7.6-0.44.4Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2rpmlinux enterprise server 11 sp42.7.6-0.44.1Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 11 sp42.7.6-0.44.4Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 11 sp42.7.6-0.44.1Not reportedSUSE-SU-2016:1604-1Not reported
Suselibxml2-pythonrpmlinux enterprise server for sap applications 11 sp42.7.6-0.44.4Not reportedSUSE-SU-2016:1604-1Not reported

[Debian bug #813613]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libxml2]Unknown
    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

[Debian 13 (Trixie)]

  • [libxml2]Unknown
    Details (4)
    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · all · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · all · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

  • Source package: [libxml2]

    Details (4)
    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.9.3+dfsg1-1.1

      dsa · libxml2 · debian · 13

Observed:

References