CVE-2015-8710

The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.

• CWE-119

• http://rhn.redhat.com/errata/RHSA-2016-1089.htmlThird Party Advisory
• http://www.debian.org/security/2015/dsa-3430Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/04/19/4Mailing List, Patch
• http://www.openwall.com/lists/oss-security/2015/09/13/1Mailing List
• http://www.openwall.com/lists/oss-security/2015/12/31/7Mailing List
• http://www.securityfocus.com/bid/79811Third Party Advisory, VDB Entry
• https://bugzilla.gnome.org/show_bug.cgi?id=746048Issue Tracking
• https://git.gnome.org/browse/libxml2/commit/?id=e724879d964d774df9b7969fc846605aa1bac54cThird Party Advisory
• https://hackerone.com/reports/57125#activity-384861Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1089.htmlThird Party Advisory
• http://www.debian.org/security/2015/dsa-3430Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/04/19/4Mailing List, Patch
• http://www.openwall.com/lists/oss-security/2015/09/13/1Mailing List
• http://www.openwall.com/lists/oss-security/2015/12/31/7Mailing List
• http://www.securityfocus.com/bid/79811Third Party Advisory, VDB Entry
• https://bugzilla.gnome.org/show_bug.cgi?id=746048Issue Tracking
• https://git.gnome.org/browse/libxml2/commit/?id=e724879d964d774df9b7969fc846605aa1bac54cThird Party Advisory
• https://hackerone.com/reports/57125#activity-384861Third Party Advisory

Published

Apr 11, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8703ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE …
• CVE-2015-8704apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x …
• CVE-2015-8705buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when …
• CVE-2015-8707Password reset tokens in Magento CE before 1.9.2.2, and Mage…
• CVE-2015-8708Stack-based buffer overflow in the conv_euctojis function in…
• CVE-2015-8709kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles…
• CVE-2015-8711epan/dissectors/packet-nbap.c in the NBAP dissector in Wires…
• CVE-2015-8712The dissect_hsdsch_channel_info function in epan/dissectors/…
• CVE-2015-8713epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in…
• CVE-2015-8714The dissect_dcom_OBJREF function in epan/dissectors/packet-d…
• CVE-2015-8715epan/dissectors/packet-alljoyn.c in the AllJoyn dissector in…
• CVE-2015-8716The init_t38_info_conv function in epan/dissectors/packet-t3…