CVE-2017-9048
HighSummary
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c may strcat two more characters to the buffer without checking if the size allows it.
Risk Assessment
This vulnerability may cause programs using libxml2, such as PHP, to crash, potentially affecting service availability in the organization.
Recommendation
It is recommended to update libxml2 to the latest version to mitigate this vulnerability and to monitor applications using this library.
Other vulnerabilities in libxml2
See all- CVE-2017-16932High
The parser.c file in libxml2 before version 2.9.5 does not prevent infinite recursion in parameter entities.
- CVE-2017-7013High
An issue was discovered in certain Apple products related to the 'libxml2' component. Affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, tvOS before 10.2.2, and watchOS before 3.2.3.
- CVE-2017-7010High
An issue was discovered in certain Apple products related to the 'libxml2' component. It affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2.
- CVE-2017-0663High
A remote code execution vulnerability in libxml2 could allow an attacker to execute arbitrary code within the context of an unprivileged process. This issue affects applications using this library on Android.
- CVE-2017-9050High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. The issue exists due to an incomplete fix for CVE-2016-1839.
- CVE-2017-9049High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash.
- CVE-2017-9047High
A buffer overflow was discovered in the libxml2 library in the xmlSnprintfElementContent function, which can lead to writing data beyond allocated memory. The issue arises when the buffer length check does not account for the updated length after appending the prefix.
- CVE-2016-4483High
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.
- CVE-2016-4449High
CVE-2016-4449 describes an XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before version 2.9.4. This vulnerability, when not in validating mode, allows attackers to read arbitrary files or cause denial of service through unspecified vectors.
- CVE-2016-4447High
The xmlParseElementDecl function in libxml2 before version 2.9.4 allows context-dependent attackers to cause a denial of service via a crafted file, resulting in heap-based buffer underread and application crash.
Original NVD description (English source)
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.