Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2022-07418

Опубликовано: 15 мая 2017
Источник: fstec
CVSS3: 7.5
CVSS2: 7.8
EPSS Низкий

Описание

Уязвимость реализации функции xmlSnprintfElementContent() библиотеки libxml2 связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании

Вендор

Canonical Ltd.
Сообщество свободного программного обеспечения
IBM Corp.
Red Hat Inc.
Intel Corp.

Наименование ПО

Ubuntu
Debian GNU/Linux
Security Guardium
Red Hat Enterprise Linux
JBoss Core Services
libxml2
App Connect Enterprise Certified Container
Cognos Analytics
Manycore Platform Software Stack (MPSS)

Версия ПО

17.04 (Ubuntu)
9 (Debian GNU/Linux)
10.0 (Security Guardium)
10.0.1 (Security Guardium)
10.1 (Security Guardium)
10.1.2 (Security Guardium)
12.04 ESM (Ubuntu)
8 (Red Hat Enterprise Linux)
14.04 ESM (Ubuntu)
8 (Debian GNU/Linux)
7 (Debian GNU/Linux)
- (JBoss Core Services)
1 (JBoss Core Services)
16.04 ESM (Ubuntu)
до 2.9.5 (libxml2)
4.1 (App Connect Enterprise Certified Container)
4.2 (App Connect Enterprise Certified Container)
5.0-lts (App Connect Enterprise Certified Container)
5.1 (App Connect Enterprise Certified Container)
5.2 (App Connect Enterprise Certified Container)
6.0 (App Connect Enterprise Certified Container)
до 11.0.10.0 (Cognos Analytics)
до 3.8.3 (Manycore Platform Software Stack (MPSS))
10.1.3 (Security Guardium)

Тип ПО

Операционная система
Программное средство защиты
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

Canonical Ltd. Ubuntu 17.04
Сообщество свободного программного обеспечения Debian GNU/Linux 9
Canonical Ltd. Ubuntu 12.04 ESM
Red Hat Inc. Red Hat Enterprise Linux 8
Canonical Ltd. Ubuntu 14.04 ESM
Сообщество свободного программного обеспечения Debian GNU/Linux 8
Сообщество свободного программного обеспечения Debian GNU/Linux 7
Canonical Ltd. Ubuntu 16.04 ESM

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,8)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,5)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для libxml2:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/932cc9896ab
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2017-9047
Для Debian:
https://security-tracker.debian.org/tracker/CVE-2017-9047
Для Ubuntu:
https://ubuntu.com/security/notices/USN-3424-1
https://ubuntu.com/security/notices/USN-3424-2
Для программных продуктов IBM Corp.:
https://www.ibm.com/support/pages/node/6837647
https://www.ibm.com/support/pages/node/567705
https://www.ibm.com/support/pages/node/868882
https://www.ibm.com/support/pages/node/295723
https://www.ibm.com/support/pages/node/301165

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует в открытом доступе

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 86%
0.02779
Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Связанные уязвимости

CVSS3: 7.5
ubuntu
больше 8 лет назад

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

CVSS3: 7.5
redhat
больше 8 лет назад

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

CVSS3: 7.5
nvd
больше 8 лет назад

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

CVSS3: 7.5
debian
больше 8 лет назад

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g074180 ...

CVSS3: 7.5
github
больше 3 лет назад

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

EPSS

Процентиль: 86%
0.02779
Низкий

7.5 High

CVSS3

7.8 High

CVSS2