CVE-2017-9050
libxml2: Heap-based buffer over-read in function xmlDictAddString
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.
libxml2 20904-GIT versión 2.9.4-16-g0741801, es vulnerable a una lectura excesiva de búfer en la región heap de la memoria en la función xmlDictAddString en el archivo dict.c. Esta vulnerabilidad causa que los programas que utilizan libxml2, como PHP, se bloqueen. Esta vulnerabilidad se presenta debido a una corrección incompleta para CVE-2016-1839.
It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. It was discovered that libxml2 did not properly validate parsed entity references. An attacker could use this to specially construct XML data that could expose sensitive information. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-05-18 CVE Reserved
- 2017-05-18 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (8)
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2017/05/15/1 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2017/dsa-3952 | 2023-11-07 | |
| https://security.gentoo.org/glsa/201711-01 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2017-9050 | 2018-08-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1452553 | 2018-08-16 |