Action not permitted
Modal body text goes here.
GHSA-8c56-cpmw-89x7
Vulnerability from github
Published
2017-12-13 21:38
Modified
2021-06-30 18:05
Severity ?
Summary
Out-of-bounds read in nokogiri
Details
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839. GitHub is notifying on nokogiri as uses libxml2.
{ "affected": [ { "package": { "ecosystem": "RubyGems", "name": "nokogiri" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.8.1" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2017-9050" ], "database_specific": { "cwe_ids": [ "CWE-125" ], "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:25:13Z", "nvd_published_at": "2017-05-18T06:29:00Z", "severity": "HIGH" }, "details": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839. GitHub is notifying on nokogiri as uses libxml2.", "id": "GHSA-8c56-cpmw-89x7", "modified": "2021-06-30T18:05:23Z", "published": "2017-12-13T21:38:24Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9050" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/201711-01" }, { "type": "WEB", "url": "http://www.debian.org/security/2017/dsa-3952" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2017/05/15/1" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Out-of-bounds read in nokogiri" }
cve-2017-9050
Vulnerability from cvelistv5
Published
2017-05-18 06:13
Modified
2024-08-05 16:55
Severity ?
EPSS score ?
Summary
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.
References
▼ | URL | Tags |
---|---|---|
http://www.securityfocus.com/bid/98568 | vdb-entry, x_refsource_BID | |
http://www.debian.org/security/2017/dsa-3952 | vendor-advisory, x_refsource_DEBIAN | |
https://security.gentoo.org/glsa/201711-01 | vendor-advisory, x_refsource_GENTOO | |
http://www.openwall.com/lists/oss-security/2017/05/15/1 | x_refsource_MISC | |
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E | mailing-list, x_refsource_MLIST | |
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E | mailing-list, x_refsource_MLIST |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T16:55:21.957Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "98568", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/98568" }, { "name": "DSA-3952", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2017/dsa-3952" }, { "name": "GLSA-201711-01", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201711-01" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2017/05/15/1" }, { "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" }, { "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2017-05-18T00:00:00", "descriptions": [ { "lang": "en", "value": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2021-06-29T14:07:42", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "98568", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/98568" }, { "name": "DSA-3952", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2017/dsa-3952" }, { "name": "GLSA-201711-01", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/201711-01" }, { "tags": [ "x_refsource_MISC" ], "url": "http://www.openwall.com/lists/oss-security/2017/05/15/1" }, { "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" }, { "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-9050", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "98568", "refsource": "BID", "url": "http://www.securityfocus.com/bid/98568" }, { "name": "DSA-3952", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3952" }, { "name": "GLSA-201711-01", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201711-01" }, { "name": "http://www.openwall.com/lists/oss-security/2017/05/15/1", "refsource": "MISC", "url": "http://www.openwall.com/lists/oss-security/2017/05/15/1" }, { "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E" }, { "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-9050", "datePublished": "2017-05-18T06:13:00", "dateReserved": "2017-05-18T00:00:00", "dateUpdated": "2024-08-05T16:55:21.957Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
gsd-2017-9050
Vulnerability from gsd
Modified
2017-09-19 00:00
Details
The version of libxml2 packaged with Nokogiri contains several
vulnerabilities. Nokogiri has mitigated these issues by upgrading to
libxml 2.9.5.
It was discovered that a type confusion error existed in libxml2. An
attacker could use this to specially construct XML data that
could cause a denial of service or possibly execute arbitrary
code. (CVE-2017-0663)
It was discovered that libxml2 did not properly validate parsed entity
references. An attacker could use this to specially construct XML
data that could expose sensitive information. (CVE-2017-7375)
It was discovered that a buffer overflow existed in libxml2 when
handling HTTP redirects. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-7376)
Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
libxml2 when handling elements. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-9047)
Marcel Böhme and Van-Thuan Pham discovered a buffer overread
in libxml2 when handling elements. An attacker could use this
to specially construct XML data that could cause a denial of
service. (CVE-2017-9048)
Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
in libxml2 when handling parameter-entity references. An attacker
could use these to specially construct XML data that could cause a
denial of service. (CVE-2017-9049, CVE-2017-9050)
Aliases
Aliases
{ "GSD": { "alias": "CVE-2017-9050", "description": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", "id": "GSD-2017-9050", "references": [ "https://www.suse.com/security/cve/CVE-2017-9050.html", "https://www.debian.org/security/2017/dsa-3952", "https://access.redhat.com/errata/RHSA-2018:2486", "https://ubuntu.com/security/CVE-2017-9050", "https://advisories.mageia.org/CVE-2017-9050.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "affected": [ { "package": { "ecosystem": "RubyGems", "name": "nokogiri", "purl": "pkg:gem/nokogiri" } } ], "aliases": [ "CVE-2017-9050", "GHSA-8c56-cpmw-89x7" ], "details": "The version of libxml2 packaged with Nokogiri contains several\nvulnerabilities. Nokogiri has mitigated these issues by upgrading to\nlibxml 2.9.5.\n\nIt was discovered that a type confusion error existed in libxml2. An\nattacker could use this to specially construct XML data that\ncould cause a denial of service or possibly execute arbitrary\ncode. (CVE-2017-0663)\n\nIt was discovered that libxml2 did not properly validate parsed entity\nreferences. An attacker could use this to specially construct XML\ndata that could expose sensitive information. (CVE-2017-7375)\n\nIt was discovered that a buffer overflow existed in libxml2 when\nhandling HTTP redirects. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-7376)\n\nMarcel B\u00f6hme and Van-Thuan Pham discovered a buffer overflow in\nlibxml2 when handling elements. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-9047)\n\nMarcel B\u00f6hme and Van-Thuan Pham discovered a buffer overread\nin libxml2 when handling elements. An attacker could use this\nto specially construct XML data that could cause a denial of\nservice. (CVE-2017-9048)\n\nMarcel B\u00f6hme and Van-Thuan Pham discovered multiple buffer overreads\nin libxml2 when handling parameter-entity references. An attacker\ncould use these to specially construct XML data that could cause a\ndenial of service. (CVE-2017-9049, CVE-2017-9050)\n", "id": "GSD-2017-9050", "modified": "2017-09-19T00:00:00.000Z", "published": "2017-09-19T00:00:00.000Z", "references": [ { "type": "WEB", "url": "https://github.com/sparklemotion/nokogiri/issues/1673" }, { "type": "WEB", "url": "https://usn.ubuntu.com/usn/usn-3424-1/" }, { "type": "WEB", "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html" }, { "type": "WEB", "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html" }, { "type": "WEB", "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html" }, { "type": "WEB", "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html" }, { "type": "WEB", "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html" }, { "type": "WEB", "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html" }, { "type": "WEB", "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html" } ], "related": [ "CVE-2017-0663", "CVE-2017-7375", "CVE-2017-7376", "CVE-2017-9047", "CVE-2017-9048", "CVE-2017-9049", "CVE-2017-9050" ], "schema_version": "1.4.0", "severity": [ { "score": 7.5, "type": "CVSS_V3" } ], "summary": "Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-9050", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "98568", "refsource": "BID", "url": "http://www.securityfocus.com/bid/98568" }, { "name": "DSA-3952", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3952" }, { "name": "GLSA-201711-01", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201711-01" }, { "name": "http://www.openwall.com/lists/oss-security/2017/05/15/1", "refsource": "MISC", "url": "http://www.openwall.com/lists/oss-security/2017/05/15/1" }, { "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E" }, { "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" } ] } }, "github.com/rubysec/ruby-advisory-db": { "cve": "2017-9050", "cvss_v3": 7.5, "date": "2017-09-19", "description": "The version of libxml2 packaged with Nokogiri contains several\nvulnerabilities. Nokogiri has mitigated these issues by upgrading to\nlibxml 2.9.5.\n\nIt was discovered that a type confusion error existed in libxml2. An\nattacker could use this to specially construct XML data that\ncould cause a denial of service or possibly execute arbitrary\ncode. (CVE-2017-0663)\n\nIt was discovered that libxml2 did not properly validate parsed entity\nreferences. An attacker could use this to specially construct XML\ndata that could expose sensitive information. (CVE-2017-7375)\n\nIt was discovered that a buffer overflow existed in libxml2 when\nhandling HTTP redirects. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-7376)\n\nMarcel B\u00f6hme and Van-Thuan Pham discovered a buffer overflow in\nlibxml2 when handling elements. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-9047)\n\nMarcel B\u00f6hme and Van-Thuan Pham discovered a buffer overread\nin libxml2 when handling elements. An attacker could use this\nto specially construct XML data that could cause a denial of\nservice. (CVE-2017-9048)\n\nMarcel B\u00f6hme and Van-Thuan Pham discovered multiple buffer overreads\nin libxml2 when handling parameter-entity references. An attacker\ncould use these to specially construct XML data that could cause a\ndenial of service. (CVE-2017-9049, CVE-2017-9050)\n", "gem": "nokogiri", "ghsa": "8c56-cpmw-89x7", "patched_versions": [ "\u003e= 1.8.1" ], "related": { "cve": [ "2017-0663", "2017-7375", "2017-7376", "2017-9047", "2017-9048", "2017-9049", "2017-9050" ], "url": [ "https://usn.ubuntu.com/usn/usn-3424-1/", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html" ] }, "title": "Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities", "url": "https://github.com/sparklemotion/nokogiri/issues/1673" }, "gitlab.com": { "advisories": [ { "affected_range": "=2.9.4", "affected_versions": "Version 2.9.4", "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cwe_ids": [ "CWE-1035", "CWE-125", "CWE-937" ], "date": "2021-06-29", "description": "libxml2 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", "fixed_versions": [], "identifier": "CVE-2017-9050", "identifiers": [ "CVE-2017-9050" ], "not_impacted": "", "package_slug": "gem/nokogiri", "pubdate": "2017-05-18", "solution": "Unfortunately, there is no solution available yet.", "title": "Out-of-bounds Read", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2017-9050", "http://www.openwall.com/lists/oss-security/2017/05/15/1", "http://www.securityfocus.com/bid/98568", "http://www.debian.org/security/2017/dsa-3952", "https://security.gentoo.org/glsa/201711-01", "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" ], "uuid": "9d3f402d-e0ee-46d5-9d33-5abc9d2a3b21" }, { "affected_range": "[2.9.4]", "affected_versions": "Version 2.9.4", "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cwe_ids": [ "CWE-1035", "CWE-125", "CWE-937" ], "date": "2021-06-29", "description": "libxml2 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", "fixed_versions": [], "identifier": "CVE-2017-9050", "identifiers": [ "CVE-2017-9050" ], "not_impacted": "", "package_slug": "nuget/libxml2", "pubdate": "2017-05-18", "solution": "Unfortunately, there is no solution available yet.", "title": "Out-of-bounds Read", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2017-9050" ], "uuid": "e53a6578-38b7-4a4b-a368-39c056855a4c" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:xmlsoft:libxml2:2.9.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-9050" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-125" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.openwall.com/lists/oss-security/2017/05/15/1", "refsource": "MISC", "tags": [ "Exploit", "Mailing List", "Patch", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2017/05/15/1" }, { "name": "98568", "refsource": "BID", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "http://www.securityfocus.com/bid/98568" }, { "name": "DSA-3952", "refsource": "DEBIAN", "tags": [], "url": "http://www.debian.org/security/2017/dsa-3952" }, { "name": "GLSA-201711-01", "refsource": "GENTOO", "tags": [], "url": "https://security.gentoo.org/glsa/201711-01" }, { "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "refsource": "MLIST", "tags": [], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E" }, { "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", "refsource": "MLIST", "tags": [], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": true, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } }, "lastModifiedDate": "2021-06-29T15:15Z", "publishedDate": "2017-05-18T06:29Z" } } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.