PT-2017-4161 · Xmlsoft+3 · Libxml2+3
Publicado
2017-10-20
·
Atualizado
2025-12-03
·
CVE-2017-5130
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libxml2 versions prior to 2.9.5
Description
The issue is related to a buffer overflow in the xmlmemory.c component of the libxml2 software for XML document analysis. This can be exploited by a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. An integer overflow in xmlmemory.c allows a remote attacker to potentially exploit heap corruption via a crafted XML file.
Recommendations
For libxml2 versions prior to 2.9.5, update to version 2.9.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the xmlmemory.c component until a patch is available. Avoid using crafted XML files that could exploit the integer overflow in xmlmemory.c until the issue is resolved.
Exploit
Correção
Memory Corruption
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Red Hat
Suse
Libxml2