CVE-2010-4494: Apache Openoffice

High severity, CVSS 7.5. EPSS: 5.9% chance of exploitation in the next 30 days.

Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

Affected products

• Apache Openoffice: from 2.1.0, up to and including 2.4.3; from 3.0.0, before 3.3.0 (fixed in 3.3.0)
• Apple iPhone OS: before 4.3.0 (fixed in 4.3.0)
• Apple iTunes: before 10.2 (fixed in 10.2)
• Apple Mac OS X: before 10.6.7 (fixed in 10.6.7)
• Apple Safari: before 5.0.4 (fixed in 5.0.4)
• Debian Debian Linux: version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 14 only
• Google Chrome: before 8.0.552.215 (fixed in 8.0.552.215)
• HP Insight Control Server Deployment: any version
• HP Rapid Deployment Pack: any version
• Opensuse Opensuse: version 11.2 only; version 11.3 only
• Red Hat Enterprise Linux Desktop: version 6.0 only
• Red Hat Enterprise Linux Eus: version 6.3 only
• Red Hat Enterprise Linux Server: version 6.0 only
• Red Hat Enterprise Linux Workstation: version 6.0 only
• Suse Suse Linux Enterprise Server: version 11 only
• Xmlsoft LIBXML2: up to and including 2.7.8

Published 2010-12-07. Last modified 2026-06-16.