Resource exhaustion in Libxml2 - CVE-2017-16932

Vulnerability identifier: #VU9542

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-16932

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in parser.c function due to improper handling of certain parameter entities. A remote attacker can supply specially constructed XML data, trigger resource exhaustion and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Libxml2
clamav (Alpine package)
libxml2-debugsource
libxml2-devel
python-libxml2-debugsource
python-libxml2-debuginfo
python-libxml2
libxml2-tools-debuginfo
libxml2-tools
libxml2-2-debuginfo-32bit
libxml2-2-debuginfo
libxml2-2-32bit
libxml2-2
libxml2-doc
Dell EMC NetWorker vProxy
Dell Secure Connect Gateway
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
SecurID Authentication Manager
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Flex System Fabric EN4093R 10Gb Scalable Switch
IBM Flex System EN2092 1Gb Ethernet Scalable Switch
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch
Flex System Fabric CN4093 10Gb ScSE firmware

Update to version 2.9.5.

clamav (Alpine package) - update to 0.100.1-r0
Dell EMC NetWorker vProxy - update to 4.3.0-32
Dell Secure Connect Gateway - update to 5.12.00.10
SecurID Authentication Manager - addressed in versions 8.6 Patch 4, 8.7 Patch 1
libxml2-debugsource - update to 2.9.4-46.54.3
libxml2-devel - update to 2.9.4-46.54.3
python-libxml2-debugsource - update to 2.9.4-46.54.3
python-libxml2-debuginfo - update to 2.9.4-46.54.3
python-libxml2 - update to 2.9.4-46.54.3
libxml2-tools-debuginfo - update to 2.9.4-46.54.3
libxml2-tools - update to 2.9.4-46.54.3
libxml2-2-debuginfo-32bit - update to 2.9.4-46.54.3
libxml2-2-debuginfo - update to 2.9.4-46.54.3
libxml2-2-32bit - update to 2.9.4-46.54.3
libxml2-2 - update to 2.9.4-46.54.3
libxml2-doc - update to 2.9.4-46.54.3
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.8.0.0
IBM Flex System Fabric EN4093R 10Gb Scalable Switch - update to 7.8.20.00
IBM Flex System EN2092 1Gb Ethernet Scalable Switch - update to 7.8.20.00
IBM Flex System Fabric SI4093 GbFSIM 10Gb Scalable Switch - update to 7.8.20.00
Flex System Fabric CN4093 10Gb ScSE firmware - update to 7.8.20.00

• http://xmlsoft.org/news.html

• Ubuntu update for libxml2
• Denial of service in libxml2
• Resource exhaustion in clamav (Alpine package)
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Multiple vulnerabilities in Dell EMC NetWorker vProxy
• Multiple vulnerabilities in Dell Storage Monitoring and Reporting (SMR)
• SUSE update for libxml2
• Multiple vulnerabilities in IBM Flex System switch firmware products
• SecurID Authentication Manager update for third-party components
• SecurID Authentication Manager update for third-party components