Resource exhaustion in Libxml2 - CVE-2017-16932
Published: December 5, 2017 / Updated: December 5, 2017
Vulnerability identifier: #VU9542
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-16932
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Libxml2
clamav (Alpine package)
libxml2-debugsource
libxml2-devel
python-libxml2-debugsource
python-libxml2-debuginfo
python-libxml2
libxml2-tools-debuginfo
libxml2-tools
libxml2-2-debuginfo-32bit
libxml2-2-debuginfo
libxml2-2-32bit
libxml2-2
libxml2-doc
Dell EMC NetWorker vProxy
Dell Secure Connect Gateway
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
SecurID Authentication Manager
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Flex System Fabric EN4093R 10Gb Scalable Switch
IBM Flex System EN2092 1Gb Ethernet Scalable Switch
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch
Flex System Fabric CN4093 10Gb ScSE firmware
Libxml2
clamav (Alpine package)
libxml2-debugsource
libxml2-devel
python-libxml2-debugsource
python-libxml2-debuginfo
python-libxml2
libxml2-tools-debuginfo
libxml2-tools
libxml2-2-debuginfo-32bit
libxml2-2-debuginfo
libxml2-2-32bit
libxml2-2
libxml2-doc
Dell EMC NetWorker vProxy
Dell Secure Connect Gateway
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
SecurID Authentication Manager
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Flex System Fabric EN4093R 10Gb Scalable Switch
IBM Flex System EN2092 1Gb Ethernet Scalable Switch
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch
Flex System Fabric CN4093 10Gb ScSE firmware
Detailed vulnerability description
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in parser.c function due to improper handling of certain parameter entities. A remote attacker can supply specially constructed XML data, trigger resource exhaustion and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
The weakness exists in parser.c function due to improper handling of certain parameter entities. A remote attacker can supply specially constructed XML data, trigger resource exhaustion and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
How to mitigate CVE-2017-16932
Update to version 2.9.5.