CVE-2013-2877

parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.

公開： 2013-07-10 最終更新： 2026-06-16 Assigner： [email protected] ソース： [email protected]
NVD ステータス：Modified，CVE の状態： published
参照： NVD, CVE.org, EUVD, JVN

CVE-2013-2877 は中リスク（55.8/100）。CVSS 深刻度は中。悪用される可能性が高い（EPSS 4.73%、91 パーセンタイル） EPSS 上、短期間での悪用可能性は高い水準です。 直近 1 日で EPSS が +4.09% 上昇。悪用への関心が高まっている可能性があります。 悪用可能性が高いため、影響範囲の確認と修補の優先付けを推奨します。

リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。

CVE-2013-2877 の EPSS（Exploit Prediction Scoring System）スコア

EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。

# 日付 旧 EPSS スコア 新 EPSS スコア Δ（新 − 旧）
1 2026-06-15 0.65% 4.73% +4.09%
2 2026-03-26 0.97% 0.65% -0.33%
3 2026-03-25 — 0.97% —

EPSS の全履歴 （全 51 件）

CVE-2013-2877 の CVSS（Common Vulnerability Scoring System）指標

この CVE の CVSS 指標。

ベーススコア バージョン 深刻度 ベクトル 悪用しやすさ 影響 スコアの出典
5.0 2.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P クリックして展開
アクセス経路 (AV:N)
ルーティング可能なネットワーク越しに、遠隔から到達・悪用しうる。
アクセスの複雑さ (AC:L)
手順が短く、再現性が高い。
認証 (AU:N)
認証を経ずに攻撃を完結できる。
機密性への影響 (C:N)
機密性は損なわれない。
完全性への影響 (I:N)
完全性は損なわれない。
可用性への影響 (A:P)
可用性は部分的に損なわれる。
 10.0 2.9 [email protected]

CVE-2013-2877 の弱点分類（列挙）

CVE-2013-2877 の OS トラッカー

vendor priority summary link
debian not yet assigned CVE-2013-2877 not yet assigned priority: Debian including 1 source packages (libxml2), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2013-2877
gentoo normal CVE-2013-2877: 3 GLSA(s) (201309-16, 201311-06, 201412-11), 4 atom(s) (app-emulation/emul-linux-x86-baselibs, dev-lang/v8, dev-libs/libxml2, www-client/chromium); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2013-2877
redhat low — https://access.redhat.com/security/cve/CVE-2013-2877
suse critical CVE-2013-2877 severity critical: SUSE including 36 source package names (libxml2, libxml2-2, …), 92 product×package rows across 25 product lines (SUSE Linux Enterprise Desktop 11 SP2, SUSE Linux Enterprise Desktop 11 SP3, … (25 product lines)): Fixed 61, Known Not Affected 31. https://www.suse.com/security/cve/CVE-2013-2877/
ubuntu medium CVE-2013-2877 medium priority: Ubuntu including 2 source packages (chromium-browser, libxml2), 10 status rows across 5 suites (lucid, precise, quantal, raring, upstream): released 9, ignored 1. https://ubuntu.com/security/CVE-2013-2877

CVE-2013-2877 の影響を受けるソフトウェア／構成

ベンダー 製品 バージョン 生の CPE
google chrome <= 28.0.1500.70 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
google chrome 28.0.1500.0 cpe:2.3:a:google:chrome:28.0.1500.0:*:*:*:*:*:*:*
google chrome 28.0.1500.2 cpe:2.3:a:google:chrome:28.0.1500.2:*:*:*:*:*:*:*
google chrome 28.0.1500.3 cpe:2.3:a:google:chrome:28.0.1500.3:*:*:*:*:*:*:*
google chrome 28.0.1500.4 cpe:2.3:a:google:chrome:28.0.1500.4:*:*:*:*:*:*:*
google chrome 28.0.1500.5 cpe:2.3:a:google:chrome:28.0.1500.5:*:*:*:*:*:*:*
google chrome 28.0.1500.6 cpe:2.3:a:google:chrome:28.0.1500.6:*:*:*:*:*:*:*
google chrome 28.0.1500.8 cpe:2.3:a:google:chrome:28.0.1500.8:*:*:*:*:*:*:*
google chrome 28.0.1500.9 cpe:2.3:a:google:chrome:28.0.1500.9:*:*:*:*:*:*:*
google chrome 28.0.1500.10 cpe:2.3:a:google:chrome:28.0.1500.10:*:*:*:*:*:*:*
google chrome 28.0.1500.11 cpe:2.3:a:google:chrome:28.0.1500.11:*:*:*:*:*:*:*
google chrome 28.0.1500.12 cpe:2.3:a:google:chrome:28.0.1500.12:*:*:*:*:*:*:*
google chrome 28.0.1500.13 cpe:2.3:a:google:chrome:28.0.1500.13:*:*:*:*:*:*:*
google chrome 28.0.1500.14 cpe:2.3:a:google:chrome:28.0.1500.14:*:*:*:*:*:*:*
google chrome 28.0.1500.15 cpe:2.3:a:google:chrome:28.0.1500.15:*:*:*:*:*:*:*
google chrome 28.0.1500.16 cpe:2.3:a:google:chrome:28.0.1500.16:*:*:*:*:*:*:*
google chrome 28.0.1500.17 cpe:2.3:a:google:chrome:28.0.1500.17:*:*:*:*:*:*:*
google chrome 28.0.1500.18 cpe:2.3:a:google:chrome:28.0.1500.18:*:*:*:*:*:*:*
google chrome 28.0.1500.19 cpe:2.3:a:google:chrome:28.0.1500.19:*:*:*:*:*:*:*
google chrome 28.0.1500.20 cpe:2.3:a:google:chrome:28.0.1500.20:*:*:*:*:*:*:*
google chrome 28.0.1500.21 cpe:2.3:a:google:chrome:28.0.1500.21:*:*:*:*:*:*:*
google chrome 28.0.1500.22 cpe:2.3:a:google:chrome:28.0.1500.22:*:*:*:*:*:*:*
google chrome 28.0.1500.23 cpe:2.3:a:google:chrome:28.0.1500.23:*:*:*:*:*:*:*
google chrome 28.0.1500.24 cpe:2.3:a:google:chrome:28.0.1500.24:*:*:*:*:*:*:*
google chrome 28.0.1500.25 cpe:2.3:a:google:chrome:28.0.1500.25:*:*:*:*:*:*:*
google chrome 28.0.1500.26 cpe:2.3:a:google:chrome:28.0.1500.26:*:*:*:*:*:*:*
google chrome 28.0.1500.27 cpe:2.3:a:google:chrome:28.0.1500.27:*:*:*:*:*:*:*
google chrome 28.0.1500.28 cpe:2.3:a:google:chrome:28.0.1500.28:*:*:*:*:*:*:*
google chrome 28.0.1500.29 cpe:2.3:a:google:chrome:28.0.1500.29:*:*:*:*:*:*:*
google chrome 28.0.1500.31 cpe:2.3:a:google:chrome:28.0.1500.31:*:*:*:*:*:*:*
google chrome 28.0.1500.32 cpe:2.3:a:google:chrome:28.0.1500.32:*:*:*:*:*:*:*
google chrome 28.0.1500.33 cpe:2.3:a:google:chrome:28.0.1500.33:*:*:*:*:*:*:*
google chrome 28.0.1500.34 cpe:2.3:a:google:chrome:28.0.1500.34:*:*:*:*:*:*:*
google chrome 28.0.1500.35 cpe:2.3:a:google:chrome:28.0.1500.35:*:*:*:*:*:*:*
google chrome 28.0.1500.36 cpe:2.3:a:google:chrome:28.0.1500.36:*:*:*:*:*:*:*
google chrome 28.0.1500.37 cpe:2.3:a:google:chrome:28.0.1500.37:*:*:*:*:*:*:*
google chrome 28.0.1500.38 cpe:2.3:a:google:chrome:28.0.1500.38:*:*:*:*:*:*:*
google chrome 28.0.1500.39 cpe:2.3:a:google:chrome:28.0.1500.39:*:*:*:*:*:*:*
google chrome 28.0.1500.40 cpe:2.3:a:google:chrome:28.0.1500.40:*:*:*:*:*:*:*
google chrome 28.0.1500.41 cpe:2.3:a:google:chrome:28.0.1500.41:*:*:*:*:*:*:*
google chrome 28.0.1500.42 cpe:2.3:a:google:chrome:28.0.1500.42:*:*:*:*:*:*:*
google chrome 28.0.1500.43 cpe:2.3:a:google:chrome:28.0.1500.43:*:*:*:*:*:*:*
google chrome 28.0.1500.44 cpe:2.3:a:google:chrome:28.0.1500.44:*:*:*:*:*:*:*
google chrome 28.0.1500.45 cpe:2.3:a:google:chrome:28.0.1500.45:*:*:*:*:*:*:*
google chrome 28.0.1500.46 cpe:2.3:a:google:chrome:28.0.1500.46:*:*:*:*:*:*:*
google chrome 28.0.1500.47 cpe:2.3:a:google:chrome:28.0.1500.47:*:*:*:*:*:*:*
google chrome 28.0.1500.48 cpe:2.3:a:google:chrome:28.0.1500.48:*:*:*:*:*:*:*
google chrome 28.0.1500.49 cpe:2.3:a:google:chrome:28.0.1500.49:*:*:*:*:*:*:*
google chrome 28.0.1500.50 cpe:2.3:a:google:chrome:28.0.1500.50:*:*:*:*:*:*:*
google chrome 28.0.1500.51 cpe:2.3:a:google:chrome:28.0.1500.51:*:*:*:*:*:*:*
google chrome 28.0.1500.52 cpe:2.3:a:google:chrome:28.0.1500.52:*:*:*:*:*:*:*
google chrome 28.0.1500.53 cpe:2.3:a:google:chrome:28.0.1500.53:*:*:*:*:*:*:*
google chrome 28.0.1500.54 cpe:2.3:a:google:chrome:28.0.1500.54:*:*:*:*:*:*:*
google chrome 28.0.1500.56 cpe:2.3:a:google:chrome:28.0.1500.56:*:*:*:*:*:*:*
google chrome 28.0.1500.58 cpe:2.3:a:google:chrome:28.0.1500.58:*:*:*:*:*:*:*
google chrome 28.0.1500.59 cpe:2.3:a:google:chrome:28.0.1500.59:*:*:*:*:*:*:*
google chrome 28.0.1500.60 cpe:2.3:a:google:chrome:28.0.1500.60:*:*:*:*:*:*:*
google chrome 28.0.1500.61 cpe:2.3:a:google:chrome:28.0.1500.61:*:*:*:*:*:*:*
google chrome 28.0.1500.62 cpe:2.3:a:google:chrome:28.0.1500.62:*:*:*:*:*:*:*
google chrome 28.0.1500.63 cpe:2.3:a:google:chrome:28.0.1500.63:*:*:*:*:*:*:*
google chrome 28.0.1500.64 cpe:2.3:a:google:chrome:28.0.1500.64:*:*:*:*:*:*:*
google chrome 28.0.1500.66 cpe:2.3:a:google:chrome:28.0.1500.66:*:*:*:*:*:*:*
google chrome 28.0.1500.68 cpe:2.3:a:google:chrome:28.0.1500.68:*:*:*:*:*:*:*
xmlsoft libxml2 <= 2.9.0 cpe:2.3:a:xmlsoft:libxml2:*:rc1:*:*:*:*:*:*
xmlsoft libxml2 1.7.0 cpe:2.3:a:xmlsoft:libxml2:1.7.0:*:*:*:*:*:*:*
xmlsoft libxml2 1.7.1 cpe:2.3:a:xmlsoft:libxml2:1.7.1:*:*:*:*:*:*:*
xmlsoft libxml2 1.7.2 cpe:2.3:a:xmlsoft:libxml2:1.7.2:*:*:*:*:*:*:*
xmlsoft libxml2 1.7.3 cpe:2.3:a:xmlsoft:libxml2:1.7.3:*:*:*:*:*:*:*
xmlsoft libxml2 1.7.4 cpe:2.3:a:xmlsoft:libxml2:1.7.4:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.0 cpe:2.3:a:xmlsoft:libxml2:1.8.0:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.1 cpe:2.3:a:xmlsoft:libxml2:1.8.1:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.2 cpe:2.3:a:xmlsoft:libxml2:1.8.2:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.3 cpe:2.3:a:xmlsoft:libxml2:1.8.3:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.4 cpe:2.3:a:xmlsoft:libxml2:1.8.4:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.5 cpe:2.3:a:xmlsoft:libxml2:1.8.5:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.6 cpe:2.3:a:xmlsoft:libxml2:1.8.6:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.7 cpe:2.3:a:xmlsoft:libxml2:1.8.7:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.9 cpe:2.3:a:xmlsoft:libxml2:1.8.9:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.10 cpe:2.3:a:xmlsoft:libxml2:1.8.10:*:*:*:*:*:*:*
xmlsoft libxml2 1.8.13 cpe:2.3:a:xmlsoft:libxml2:1.8.13:*:*:*:*:*:*:*

CVE-2013-2877 の参考情報

URL タグ
ftp://xmlsoft.org/libxml2/libxml2-2.9.0.tar.gz
http://git.chromium.org/gitweb/?p=chromium/chromium.git%3Ba=commit%3Bh=e5d7f7e5dc21d3ae7be3cbb949ac4d8701e06de1
http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html
http://lists.opensuse.org/opensuse-updates/2013-07/msg00063.html
http://lists.opensuse.org/opensuse-updates/2013-07/msg00077.html
http://seclists.org/fulldisclosure/2014/Dec/23
http://secunia.com/advisories/54172
http://secunia.com/advisories/55568
http://www.debian.org/security/2013/dsa-2724
http://www.debian.org/security/2013/dsa-2779
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.securityfocus.com/archive/1/534161/100/0/threaded
http://www.securityfocus.com/bid/61050
http://www.ubuntu.com/usn/USN-1904-1
http://www.ubuntu.com/usn/USN-1904-2
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
https://code.google.com/p/chromium/issues/detail?id=229019
cvelogic Threat Intelligence