CVE-2013-2877
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products...
CVE-2013-2877 is a medium vulnerability (CVSS 5.0) in Google Chrome, published July 10, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.95%, the 92nd percentile. Fixed in libxml2 2.9.1+dfsg1-1.
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
Exploit likelihood
What each source reports
NVD Score used
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
- Record
CVE-2013-2877- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
- Record
CVE-2013-2877- Updated
- 2026-11-02
EUVDEUVD-2013-2816 No score
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
- Record
EUVD-2013-2816- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fx83-qvvj-7h25 No score
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products...
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
- Record
GHSA-fx83-qvvj-7h25- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
- Record
CVE-2013-2877- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2877 No score
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
- Record
DEBIAN-CVE-2013-2877- Updated
- 2026-11-02
Show 8 moreShow less
OSVMGASA-2013-0218 No score
Updated libxml2 packages fix CVE-2013-2877
It was discovered that libxml2 incorrectly handled documents that end abruptly. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service (CVE-2013-2877).
- Record
MGASA-2013-0218- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10549-1 No score
ruby2.2-rubygem-nokogiri-1.6.8.1-1.3 on GA media
These are all security issues fixed in the ruby2.2-rubygem-nokogiri-1.6.8.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10549-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11340-1 No score
ruby2.7-rubygem-nokogiri-1.12.3-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-nokogiri-1.12.3-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11340-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11912-1 No score
ruby3.1-rubygem-nokogiri-1.13.3-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11912-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13165-1 No score
ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media
These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13165-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14174-1 No score
ruby3.3-rubygem-nokogiri-1.15.5-1.5 on GA media
These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14174-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14697-1 No score
ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14697-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10356-1 No score
ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media
These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10356-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxml2Debian:12 |
before 2.9.1+dfsg1-1 | 2.9.1+dfsg1-1 |
libxml2Debian:13 |
before 2.9.1+dfsg1-1 | 2.9.1+dfsg1-1 |
libxml2Debian:14 |
before 2.9.1+dfsg1-1 | 2.9.1+dfsg1-1 |
chromium-browserDebian:7 |
before 28.0.1500.71-1~deb7u1, plus listed versions 26.0.1410.43-127.0.1453.110-127.0.1453.110-1~deb7u127.0.1453.110-227.0.1453.93-127.0.1453.93-1~deb7u1 |
28.0.1500.71-1~deb7u1 |
libxml2Debian:6.0 |
before 2.7.8.dfsg-2+squeeze8, plus listed versions 2.7.8.dfsg-22.7.8.dfsg-2+squeeze12.7.8.dfsg-2+squeeze22.7.8.dfsg-2+squeeze32.7.8.dfsg-2+squeeze42.7.8.dfsg-2+squeeze52.7.8.dfsg-2+squeeze62.7.8.dfsg-2+squeeze7 |
2.7.8.dfsg-2+squeeze8 |
libxml2Debian:7 |
before 2.8.0+dfsg1-7+nmu2, plus listed versions 2.8.0+dfsg1-7+nmu1 |
2.8.0+dfsg1-7+nmu2 |
libxml2Mageia:2 |
before 2.7.8-14.20120229.8.mga2 | 2.7.8-14.20120229.8.mga2 |
libxml2Mageia:3 |
before 2.9.0-5.2.mga3 | 2.9.0-5.2.mga3 |
libxml2Red Hat:enterprise_linux:6::client |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-debuginfoRed Hat:enterprise_linux:6::client |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libxml2-pythonRed Hat:enterprise_linux:6::client |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-develRed Hat:enterprise_linux:6::client |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-staticRed Hat:enterprise_linux:6::client |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2Red Hat:enterprise_linux:6::computenode |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-pythonRed Hat:enterprise_linux:6::computenode |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-develRed Hat:enterprise_linux:6::computenode |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-staticRed Hat:enterprise_linux:6::computenode |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2Red Hat:enterprise_linux:6::server |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-debuginfoRed Hat:enterprise_linux:6::server |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-develRed Hat:enterprise_linux:6::server |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-pythonRed Hat:enterprise_linux:6::server |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-staticRed Hat:enterprise_linux:6::server |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2Red Hat:enterprise_linux:6::workstation |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-develRed Hat:enterprise_linux:6::workstation |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-pythonRed Hat:enterprise_linux:6::workstation |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
libxml2-staticRed Hat:enterprise_linux:6::workstation |
before 0:2.7.6-14.el6_5.1 | 0:2.7.6-14.el6_5.1 |
rubygem-nokogiriopenSUSE:Tumbleweed |
before 1.6.8.1-1.3 | 1.6.8.1-1.3 |
rubygem-nokogiriopenSUSE:Tumbleweed |
before 1.13.3-1.1 | 1.13.3-1.1 |
ruby3.2-rubygem-nokogiriopenSUSE:Tumbleweed |
before 1.13.9-1.7 | 1.13.9-1.7 |
rubygem-nokogiriopenSUSE:Tumbleweed |
before 1.15.5-1.5 | 1.15.5-1.5 |
rubygem-nokogiriopenSUSE:Tumbleweed |
before 1.18.2-1.1 | 1.18.2-1.1 |
rubygem-nokogiriopenSUSE:Tumbleweed |
before 1.18.9-1.4 | 1.18.9-1.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
debian.org/security/2013/dsa-2779
lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html
vmware.com/security/advisories/VMSA-2014-0012.html
securityfocus.com/bid/61050
code.google.com/p/chromium/issues/detail?id=229019
Show 73 moreShow less
oracle.com/technetwork/topics/security/cpujan2015-1972971.html
ubuntu.com/usn/USN-1904-2
git.chromium.org/gitweb?p=chromium/chromium.git%3Ba=commit%3Bh=e5d7f7e5dc21d3ae7be3cbb949ac4d8701e06de1
secunia.com/advisories/54172
seclists.org/fulldisclosure/2014/Dec/23
googlechromereleases.blogspot.com/2013/07/stable-channel-update.html
nvd.nist.gov/vuln/detail/CVE-2013-2877
github.com/advisories/GHSA-fx83-qvvj-7h25
security-tracker.debian.org/tracker/CVE-2013-2877
advisories.mageia.org/MGASA-2013-0218.html
bugs.mageia.org/show_bug.cgi?id=10774
access.redhat.com/errata/RHSA-2014:0513
bugzilla.redhat.com/show_bug.cgi?id=983204
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0513.json
cve.org/CVERecord?id=CVE-2013-2877
suse.com/security/cve/CVE-2013-2877