9.8
CVSSv3

CVE-2017-7376

Published: 19/02/2018 Updated: 17/05/2019
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 890
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

Buffer overflow in libxml2 allows remote malicious users to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

xmlsoft libxml2

google android 7.1.2

google android 6.0.1

google android 5.0.2

google android 5.1.1

google android 4.4.4

google android 7.1.1

google android 7.0

google android 6.0

debian debian linux 8.0

debian debian linux 9.0

Vendor Advisories

Several security issues were fixed in libxml2 ...
Several security issues were fixed in libxml2 ...
Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the application, information leaks, or potentially, the execu ...
Debian Bug report logs - #870865 libxml2: CVE-2017-7376: Incorrect limit used for port values Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 5 Aug 2017 20:39:02 UTC Severity: im ...
Debian Bug report logs - #863022 libxml2: CVE-2017-9047: stack overflow in validc Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 May 2017 09:36:02 UTC Severity: important Tag ...
Debian Bug report logs - #870867 libxml2: CVE-2017-7375: Missing validation for external entities in xmlParsePEReference Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 5 Aug 2017 ...
Debian Bug report logs - #870870 libxml2: CVE-2017-0663: Heap buffer overflow in xmlAddID Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 5 Aug 2017 21:03:01 UTC Severity: import ...
Debian Bug report logs - #863019 libxml2: CVE-2017-9049: heap-based buffer overflow in xmlDictComputeFastKey Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 May 2017 09:12:01 UT ...
Debian Bug report logs - #863022 libxml2: CVE-2017-9047: stack overflow in validc Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 May 2017 09:36:02 UTC Severity: important Tag ...
Debian Bug report logs - #863021 libxml2: CVE-2017-9048: another stack overflow in validc Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 May 2017 09:24:01 UTC Severity: impor ...
Debian Bug report logs - #863018 libxml2: CVE-2017-9050: heap-based buffer overflow in xmlDictAddString Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 May 2017 09:03:02 UTC Se ...
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects ...

Github Repositories

An example exploit for CVE-2017-7376

libxml2-exploit An example exploit for CVE-2017-7376 Install Download this repo and a vulnerable version of libxml2, eg v277: git clone githubcom/brahmstaedt/libxml2-exploitgit cd libxml2-exploit wget githubcom/GNOME/libxml2/archive/v277zip unzip v277zip mv libxml2-277/ libxml2 Setup cd libxml2