CVE-2017-9049CWE-125

CVE-2017-9049

High · published May 18, 2017

CVSS v3.1
7.5
EPSS
5%
Percentile
91.6
In the wild
Unconfirmed
What it is

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.04626 · 91.6th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2017-05-18T10:29Z
Affected products (1)
ProductVersionsFixed in
xmlsoft/libxml2all versions—
References (13)
http://www.debian.org/security/2017/dsa-3952 · [email protected]http://www.openwall.com/lists/oss-security/2017/05/15/1 · [email protected]http://www.securityfocus.com/bid/98601 · [email protected]https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E · [email protected]https://security.gentoo.org/glsa/201711-01 · [email protected]http://www.debian.org/security/2017/dsa-3952 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2017/05/15/1 · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/98601 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201711-01 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 18 MAY 06:13Z
    libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c
    cvelistv5