$ cve CVE-2004-0989 JSON

CVE-2004-0989 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 21.7% (pctl 98)

Patch early

A public exploit exists.

Description

Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	21.69% — more likely to be exploited than 98% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2005-03-01
Last modified	2026-06-16

Affected (6)

Vendor	Product
redhat	fedora core
trustix	secure linux
ubuntu	ubuntu linux
xmlsoft	libxml
xmlsoft	libxml2
xmlstarlet	command line xml toolkit

Public exploits

Source	Title	Date
exploit-db	Libxml2 - Multiple Remote Stack Buffer Overflow Vulnerabilities	2004-10-26

References

→ the Explorer · watch your stack · NVD