CVE-2017-5130
chromium-browser: heap overflow in libxml2
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.
Un desbordamiento de enteros en xmlmemory.c en versiones anteriores a la 2.9.5 de libxml2, tal y como se emplea en Google Chrome, en versiones anteriores a la 62.0.3202.62 y en otros productos, permite que un atacante remoto explote la corrupción de la memoria dinámica (heap) mediante un archivo XML manipulado.
A heap overflow flaw was found in the libxml2 library. An application compiled with libxml2 using the vulnerable debug-only function xmlMemoryStrdup could be used by an attacker to crash the application or execute arbitrary code with the permission of the user running the application.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-01-02 CVE Reserved
- 2017-10-20 CVE Published
- 2023-09-03 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (13)
URL | Tag | Source |
---|---|---|
http://bugzilla.gnome.org/show_bug.cgi?id=783026 | Issue Tracking | |
http://www.securityfocus.com/bid/101482 | Third Party Advisory | |
https://crbug.com/722079 | Third Party Advisory | |
https://git.gnome.org/browse/libxml2/commit/?id=897dffbae322b46b83f99a607d527058a72c51ed | Third Party Advisory | |
https://lists.debian.org/debian-lts-announce/2017/11/msg00034.html | Mailing List | |
https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html | Mailing List | |
https://security.netapp.com/advisory/ntap-20190719-0001 | X_refsource_confirm | |
https://www.oracle.com/security-alerts/cpuapr2020.html | X_refsource_misc |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2017:2997 | 2022-04-08 | |
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html | 2022-04-08 | |
https://security.gentoo.org/glsa/201710-24 | 2022-04-08 | |
https://access.redhat.com/security/cve/CVE-2017-5130 | 2017-10-20 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1503537 | 2017-10-20 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Google Search vendor "Google" | Chrome Search vendor "Google" for product "Chrome" | < 62.0.3202.62 Search vendor "Google" for product "Chrome" and version " < 62.0.3202.62" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
Xmlsoft Search vendor "Xmlsoft" | Libxml2 Search vendor "Xmlsoft" for product "Libxml2" | < 2.9.5 Search vendor "Xmlsoft" for product "Libxml2" and version " < 2.9.5" | - |
Affected
|