CVE-2008-3281: Apple iPhone OS

Medium severity, CVSS 6.5. EPSS: 2.5% chance of exploitation in the next 30 days.

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

Affected products

• Apple iPhone OS: from 1.0.0, before 3.0 (fixed in 3.0)
• Apple Safari: before 4.0 (fixed in 4.0)
• Canonical Ubuntu Linux: version 6.06 only; version 7.04 only; version 7.10 only; version 8.04 only
• Debian Debian Linux: version 4.0 only
• Fedoraproject Fedora: version 9 only
• Red Hat Enterprise Linux Desktop: version 3.0 only; version 4.0 only; version 5.0 only
• Red Hat Enterprise Linux Eus: version 4.7 only; version 5.2 only
• Red Hat Enterprise Linux Server: version 2.0 only; version 3.0 only; version 4.0 only; version 5.0 only
• Red Hat Enterprise Linux Workstation: version 2.0 only; version 3.0 only; version 4.0 only; version 5.0 only
• VMware Esx: version 2.5.4 only; version 2.5.5 only; version 3.0.2 only; version 3.0.3 only
• Xmlsoft LIBXML2: up to and including 2.6.32

Published 2008-08-27. Last modified 2026-06-16.