A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 6 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.
Summary
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 1 advisory
- RHSA-2018:2486 Released 2018-08-16 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.29 security update
- Red Hat JBoss Core Services
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat JBoss Core Services | Affected | No fix yet |
| Red Hat JBoss Enterprise Web Server 3 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Core Services | Fixed | RHSA-2018:2486 |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2017-9047
- 2026-10-03 Alias added: GHSA-m5m9-w72w-8c23
References
Advisory 2
Other 2
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
More xmlsoft Libxml2 vulnerabilities
- TI-2020-06117 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. CVSS 3.1HIGH 7.5
- TI-2025-05441 Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 CVSS 3.1HIGH 7.5
- TI-2024-22792 An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. CVSS 3.1HIGH 7.5
- TI-2017-06514 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the… CVSS 3.1HIGH 7.5
- TI-2022-19140 An issue was discovered in libxml2 before 2.10.3. CVSS 3.1HIGH 7.5
- TI-2025-23491 Out-of-bounds read in xmlsoft libxml2 CVSS 3.1HIGH 7.5
Sources
- CVE-2017-9047 · CVE Program
- CVE-2017-9047 · NVD
- FIRST EPSS
- GHSA-m5m9-w72w-8c23 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-9047 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences