Published: 18/05/2017 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

A buffer overflow exists in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xmlsoft libxml2 2.9.4

Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2429 security update Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services Pack Apache Server 2429 packages for Microsoft Windows and Oracle Solaris are now availableRed Hat Product Security has rated this release ...

Several security issues were fixed in libxml2 ...

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the application, information leaks, or potentially, the execu ...

Debian Bug report logs - #870865 libxml2: CVE-2017-7376: Incorrect limit used for port values Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 5 Aug 2017 20:39:02 UTC Severity: im ...

Debian Bug report logs - #863022 libxml2: CVE-2017-9047: stack overflow in validc Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 May 2017 09:36:02 UTC Severity: important Tag ...

Debian Bug report logs - #870867 libxml2: CVE-2017-7375: Missing validation for external entities in xmlParsePEReference Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 5 Aug 2017 ...

Debian Bug report logs - #870870 libxml2: CVE-2017-0663: Heap buffer overflow in xmlAddID Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 5 Aug 2017 21:03:01 UTC Severity: import ...

Debian Bug report logs - #863019 libxml2: CVE-2017-9049: heap-based buffer overflow in xmlDictComputeFastKey Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 May 2017 09:12:01 UT ...

Debian Bug report logs - #863021 libxml2: CVE-2017-9048: another stack overflow in validc Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 May 2017 09:24:01 UTC Severity: impor ...

Debian Bug report logs - #863018 libxml2: CVE-2017-9050: heap-based buffer overflow in xmlDictAddString Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 20 May 2017 09:03:02 UTC Se ...

A buffer overflow was discovered in libxml2 20904-GITv294-16-g0741801 The function xmlSnprintfElementContent in validc is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size' The variable len is assigned strlen(buf) If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content-> ...

Critical Infrastructure Sectors: Critical Manufacturing

Safe libc using introspection

What is this? This code consists of wrapper functions that filter parameters of potentially "unsafe" libc functions (like gets) to make them usable without the risk of of buffer overflows How does it work? Code is instrumented with AddressSanitizer and wrapper functions around (potentially) unsafe libc functions use information from AddressSanitizer to prevent buffer

CWE-119 http://www.openwall.com/lists/oss-security/2017/05/15/1 http://www.securityfocus.com/bid/98599 http://www.debian.org/security/2017/dsa-3952 https://security.gentoo.org/glsa/201711-01 https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://access.redhat.com/errata/RHSA-2018:2486 https://nvd.nist.gov https://usn.ubuntu.com/3424-2/https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10

Get Started

CVE-2017-9047

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect