CVE-2017-9049
libxml2: Heap-based buffer over-read in function xmlDictComputeFastKey
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.
libxml2 20904-GIT versión 2.9.4-16-g0741801, es vulnerable a una lectura excesiva de búfer en la región heap de la memoria en la función xmlDictComputeFastKey en el archivo dict.c. Esta vulnerabilidad causa que los programas que utilizan libxml2, como PHP, se bloqueen. Esta vulnerabilidad se presenta debido a una corrección incompleta para libxml2 Bug 759398.
It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. It was discovered that libxml2 did not properly validate parsed entity references. An attacker could use this to specially construct XML data that could expose sensitive information. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-05-18 CVE Reserved
- 2017-05-18 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (8)
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2017/05/15/1 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2017/dsa-3952 | 2023-11-07 | |
| https://security.gentoo.org/glsa/201711-01 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2017-9049 | 2018-08-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1452556 | 2018-08-16 |