PT-2017-4229 · Php+4 · Php+4
CVE-2017-9047
·
Publicado
2017-05-15
·
Atualizado
2025-02-22
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libxml2 version 20904-GITv2.9.4-16-g0741801
Description
A buffer overflow issue was discovered in the
xmlSnprintfElementContent function, which can cause programs using libxml2, such as PHP, to crash. The problem arises when the function attempts to recursively dump element content into a char buffer buf of size size. The variable len is assigned the value of strlen(buf), but the check for whether the content fits in the buffer uses the outdated len value instead of the updated buffer length strlen(buf). This allows writing beyond the allocated memory, potentially leading to a crash. The issue can be exploited by a remote attacker to cause a denial of service.Recommendations
For libxml2 version 20904-GITv2.9.4-16-g0741801, consider disabling the
xmlSnprintfElementContent function until a patch is available to prevent potential crashes.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Buffer Overflow
Heap Based Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Php
Suse
Ubuntu
Libxml2