Buffer over-read in Libxml2 - CVE-2017-8872

Vulnerability identifier: #VU9690

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-8872

CWE-ID: CWE-126

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition on the target system.

The weakness exists in the htmlParseTryOrFinish function of XMLSoft libxml2 due to buffer over-read condition in the HTMLparser.c source code. A remote attacker can send a specially crafted XML file, trick the victim into opening it and read arbitrary data or cause the service to crash.

Successful exploitation of the vulnerability results in denial of service.

Libxml2
cflinuxfs3
APM Edge
Ubuntu
Fedora
libxml2 (Ubuntu package)
libxml2-utils (Ubuntu package)
libxml2

Install update from vendor's website.

cflinuxfs3 - update to 0.245.0
APM Edge - update to 4.0
libxml2 (Ubuntu package) - addressed in versions 2.9.4+dfsg1-6.1ubuntu1.4, 2.9.10+dfsg-6.3ubuntu0.1, 2.9.10+dfsg-5ubuntu0.20.04.1, 2.9.10+dfsg-5ubuntu0.20.10.2
libxml2-utils (Ubuntu package) - addressed in versions 2.9.4+dfsg1-6.1ubuntu1.4, 2.9.10+dfsg-6.3ubuntu0.1, 2.9.10+dfsg-5ubuntu0.20.04.1, 2.9.10+dfsg-5ubuntu0.20.10.2
libxml2 - addressed in versions 2.9.7-1.fc26, 2.9.7-1.fc27

• http://www.vuxml.org/freebsd/76e59f55-4f7a-4887-bcb0-11604004163a.html

• Multiple vulnerabilities in libxml2
• Multiple vulnerabilities in cflinuxfs3
• Multiple vulnerabilities in Hitachi Energy APM Edge
• Ubuntu update for libxml2
• Fedora 27 update for libxml2
• Fedora 26 update for libxml2