CVE-2017-9048: xmlsoft libxml2

Vulnerability summary

CVE-2017-9048 is a high (CVSS 7.5) vulnerability in xmlsoft libxml2. EPSS estimates a 4.85% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-05-2017
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.