Stack-based buffer overflow in Libxml2 - CVE-2017-9048

Vulnerability identifier: #VU9691

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9048

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the xmlSnprintfElementContent function of XMLSoft libxml2 due to improper bounds checking in the valid.c code. A remote attacker can send a specially crafted request, trigger stack-based buffer overflow condition and cause the service to crash.

Successful exploitation of the vulnerability results in denial of service.

Libxml2
Gentoo Linux
Fedora
IBM Security Guardium
Integrated Management Module II (IMM2)
libxml2
IBM Cloud Transformation Advisor
App Connect Enterprise Certified Container

Install update from vendor's website.

IBM Security Guardium - update to 10.0p400
Integrated Management Module II (IMM2) - addressed in versions 1AOO80G-6.40, 1AOO80G-6.40_bc
libxml2 - addressed in versions 2.9.7-1.fc26, 2.9.7-1.fc27
IBM Cloud Transformation Advisor - update to 3.5.0
App Connect Enterprise Certified Container - addressed in versions 5.0.1, 6.1.0

• http://www.vuxml.org/freebsd/76e59f55-4f7a-4887-bcb0-11604004163a.html

• Multiple vulnerabilities in libxml2
• Gentoo update for libxml2
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Integrated Management Module II (IMM2) for System x, Flex and BladeCenter Systems
• Fedora 27 update for libxml2
• Fedora 26 update for libxml2
• Multiple vulnerabilities in IBM Security Guardium