PT-2016-3347 · Libxml2+3 · Libxml2+3

Deng Yi · Published 2016-11-28 · Updated 2025-12-17 · CVE-2017-8872

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.4

Description The issue is related to the htmlParseTryOrFinish function in HTMLparser.c in libxml2, which allows attackers to cause a denial of service (buffer over-read) or information disclosure. This is due to a buffer over-read issue, enabling a remote attacker to access confidential data and cause a denial of service.

Recommendations For libxml2 version 2.9.4, consider disabling the htmlParseTryOrFinish function as a temporary workaround until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2021-03351

CVE-2017-8872

DLA-2369-1

SUSE-SU-2017:2115-1

SUSE-SU-2017:2141-1

SUSE-SU-2017_2115-1

SUSE-SU-2017_2141-1

USN-4991-1

Affected Products

Linuxmint

Suse

Ubuntu

Libxml2

References · 76

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3537 · Security Note
• https://ubuntu.com/security/CVE-2021-3541 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2369-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977 · Security Note
• https://bdu.fstec.ru/vul/2021-03351 · Security Note
• https://ubuntu.com/security/notices/USN-4991-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/685436 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=47416144 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3517 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18258 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-8872 · Security Note
• https://bdu.fstec.ru/vul/2020-04513 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7595 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19956 · Security Note