CVE-2010-4008: Apache Openoffice

Medium severity, CVSS 4.3. EPSS: 2.7% chance of exploitation in the next 30 days.

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

Affected products

• Apache Openoffice: from 2.0.0, up to and including 2.4.3; from 3.0.0, before 3.3.0 (fixed in 3.3.0)
• Apple iPhone OS: before 4.2 (fixed in 4.2)
• Apple iTunes: before 10.2 (fixed in 10.2)
• Apple Mac OS X: before 10.6.7 (fixed in 10.6.7)
• Apple Safari: before 5.0.4 (fixed in 5.0.4)
• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 9.10 only; version 10.04 only; version 10.10 only
• Debian Debian Linux: version 5.0 only; version 6.0 only
• Google Chrome: before 7.0.517.44 (fixed in 7.0.517.44)
• Opensuse Opensuse: version 11.1 only; version 11.2 only; version 11.3 only
• Red Hat Enterprise Linux Desktop: version 6.0 only
• Red Hat Enterprise Linux Server: version 6.0 only
• Red Hat Enterprise Linux Server Eus: version 6.3 only
• Red Hat Enterprise Linux Workstation: version 6.0 only
• Suse Suse Linux Enterprise Server: version 10 only; version 11 only
• Xmlsoft LIBXML2: before 2.7.8 (fixed in 2.7.8)

Published 2010-11-17. Last modified 2026-06-16.