Buffer overflow in Xmlsoft Libxml2
CVE-2017-9047
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.032 (87.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 87.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.032 · newest: 0.032 · change: 0.000
Affected products
- Xmlsoft Libxml2 — versions 2.9.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/98599 (VDB Entry, Third Party Advisory, vdb-entry)
- www.debian.org/security/2017/dsa-3952 (vendor-advisory)
- security.gentoo.org/glsa/201711-01 (vendor-advisory)
- www.openwall.com/lists/oss-security/2017/05/15/1 (Exploit, Patch, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a4508… (mailing-list)
- lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698… (mailing-list)
Frequently asked questions
- What is CVE-2017-9047?
- CVE-2017-9047 is a high-severity vulnerability in Xmlsoft Libxml2, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.5/10. Published 2017-05-18.
- How severe is CVE-2017-9047?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2017-9047 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.