Servers and applications
CVE-2010-4008
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
- Severity
- Medium 4.3
- Published
- 17 Nov 2010
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 2.7.8
- Exploit chance
- 2.7% in the next 30 daysHigher than 86% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- Memory buffer errors (CWE-119)
- Attack
- Over the network · No login needed
- Attacker can
- Slow it down
- CVSS vector
AV:N/AC:M/Au:N/C:N/I:N/A:P- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
libxml2Servers and applications · cpe:a:xmlsoft:libxml2 |
|