CVE-2017-9048 Memory corruption in n/a
A stack-based buffer overflow in libxml2 allows attackers to cause a denial of service via crafted XML input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9048?
CVE-2017-9048 is a high-severity memory corruption vulnerability in Xmlsoft Libxml2, published on 18 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.
Weakness: CWE-119
Which versions are affected by CVE-2017-9048?
It affects 1 product.
Products include Xmlsoft Libxml2.
How do I fix CVE-2017-9048?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-9048 being exploited?
There is no known exploitation of CVE-2017-9048 in the wild and no public exploit code.
Other vulnerabilities in Xmlsoft Libxml2
Sources
Also known as DEBIAN-CVE-2017-9048, ECHO-254a-44ab-2d9b, GHSA-rf96-7wvx-58w8, UBUNTU-CVE-2017-9048.