CVE-2017-9048

Publication date 18 May 2017

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

Status

Package Ubuntu Release Status
libxml2 17.04 zesty
Fixed 2.9.4+dfsg1-2.2ubuntu0.1
16.10 yakkety Ignored end of life
16.04 LTS xenial
Fixed 2.9.3+dfsg1-1ubuntu0.3
14.04 LTS trusty
Fixed 2.9.1+dfsg1-3ubuntu4.10

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libxml2

Severity score breakdown

Parameter Value
Base score 7.5 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-3424-1
    • libxml2 vulnerabilities
    • 19 September 2017
    • USN-3424-2
    • libxml2 vulnerabilities
    • 10 October 2017

Other references