Action not permitted
Modal body text goes here.
Modal Title
Modal Body
GHSA-8c56-cpmw-89x7
Vulnerability from github
Published
2017-12-13 21:38
Modified
2021-06-30 18:05
Severity ?
Summary
Out-of-bounds read in nokogiri
Details
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839. GitHub is notifying on nokogiri as uses libxml2.
{ affected: [ { package: { ecosystem: "RubyGems", name: "nokogiri", }, ranges: [ { events: [ { introduced: "0", }, { fixed: "1.8.1", }, ], type: "ECOSYSTEM", }, ], }, ], aliases: [ "CVE-2017-9050", ], database_specific: { cwe_ids: [ "CWE-125", ], github_reviewed: true, github_reviewed_at: "2020-06-16T21:25:13Z", nvd_published_at: "2017-05-18T06:29:00Z", severity: "HIGH", }, details: "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839. GitHub is notifying on nokogiri as uses libxml2.", id: "GHSA-8c56-cpmw-89x7", modified: "2021-06-30T18:05:23Z", published: "2017-12-13T21:38:24Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2017-9050", }, { type: "WEB", url: "https://security.gentoo.org/glsa/201711-01", }, { type: "WEB", url: "http://www.debian.org/security/2017/dsa-3952", }, { type: "WEB", url: "http://www.openwall.com/lists/oss-security/2017/05/15/1", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", type: "CVSS_V3", }, ], summary: "Out-of-bounds read in nokogiri", }
gsd-2017-9050
Vulnerability from gsd
Modified
2017-09-19 00:00
Details
The version of libxml2 packaged with Nokogiri contains several
vulnerabilities. Nokogiri has mitigated these issues by upgrading to
libxml 2.9.5.
It was discovered that a type confusion error existed in libxml2. An
attacker could use this to specially construct XML data that
could cause a denial of service or possibly execute arbitrary
code. (CVE-2017-0663)
It was discovered that libxml2 did not properly validate parsed entity
references. An attacker could use this to specially construct XML
data that could expose sensitive information. (CVE-2017-7375)
It was discovered that a buffer overflow existed in libxml2 when
handling HTTP redirects. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-7376)
Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
libxml2 when handling elements. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-9047)
Marcel Böhme and Van-Thuan Pham discovered a buffer overread
in libxml2 when handling elements. An attacker could use this
to specially construct XML data that could cause a denial of
service. (CVE-2017-9048)
Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
in libxml2 when handling parameter-entity references. An attacker
could use these to specially construct XML data that could cause a
denial of service. (CVE-2017-9049, CVE-2017-9050)
Aliases
Aliases
{ GSD: { alias: "CVE-2017-9050", description: "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", id: "GSD-2017-9050", references: [ "https://www.suse.com/security/cve/CVE-2017-9050.html", "https://www.debian.org/security/2017/dsa-3952", "https://access.redhat.com/errata/RHSA-2018:2486", "https://ubuntu.com/security/CVE-2017-9050", "https://advisories.mageia.org/CVE-2017-9050.html", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { affected: [ { package: { ecosystem: "RubyGems", name: "nokogiri", purl: "pkg:gem/nokogiri", }, }, ], aliases: [ "CVE-2017-9050", "GHSA-8c56-cpmw-89x7", ], details: "The version of libxml2 packaged with Nokogiri contains several\nvulnerabilities. Nokogiri has mitigated these issues by upgrading to\nlibxml 2.9.5.\n\nIt was discovered that a type confusion error existed in libxml2. An\nattacker could use this to specially construct XML data that\ncould cause a denial of service or possibly execute arbitrary\ncode. (CVE-2017-0663)\n\nIt was discovered that libxml2 did not properly validate parsed entity\nreferences. An attacker could use this to specially construct XML\ndata that could expose sensitive information. (CVE-2017-7375)\n\nIt was discovered that a buffer overflow existed in libxml2 when\nhandling HTTP redirects. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-7376)\n\nMarcel Böhme and Van-Thuan Pham discovered a buffer overflow in\nlibxml2 when handling elements. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-9047)\n\nMarcel Böhme and Van-Thuan Pham discovered a buffer overread\nin libxml2 when handling elements. An attacker could use this\nto specially construct XML data that could cause a denial of\nservice. (CVE-2017-9048)\n\nMarcel Böhme and Van-Thuan Pham discovered multiple buffer overreads\nin libxml2 when handling parameter-entity references. An attacker\ncould use these to specially construct XML data that could cause a\ndenial of service. (CVE-2017-9049, CVE-2017-9050)\n", id: "GSD-2017-9050", modified: "2017-09-19T00:00:00.000Z", published: "2017-09-19T00:00:00.000Z", references: [ { type: "WEB", url: "https://github.com/sparklemotion/nokogiri/issues/1673", }, { type: "WEB", url: "https://usn.ubuntu.com/usn/usn-3424-1/", }, { type: "WEB", url: "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html", }, { type: "WEB", url: "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html", }, { type: "WEB", url: "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html", }, { type: "WEB", url: "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html", }, { type: "WEB", url: "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html", }, { type: "WEB", url: "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html", }, { type: "WEB", url: "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html", }, ], related: [ "CVE-2017-0663", "CVE-2017-7375", "CVE-2017-7376", "CVE-2017-9047", "CVE-2017-9048", "CVE-2017-9049", "CVE-2017-9050", ], schema_version: "1.4.0", severity: [ { score: 7.5, type: "CVSS_V3", }, ], summary: "Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2017-9050", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "98568", refsource: "BID", url: "http://www.securityfocus.com/bid/98568", }, { name: "DSA-3952", refsource: "DEBIAN", url: "http://www.debian.org/security/2017/dsa-3952", }, { name: "GLSA-201711-01", refsource: "GENTOO", url: "https://security.gentoo.org/glsa/201711-01", }, { name: "http://www.openwall.com/lists/oss-security/2017/05/15/1", refsource: "MISC", url: "http://www.openwall.com/lists/oss-security/2017/05/15/1", }, { name: "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", }, { name: "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", }, ], }, }, "github.com/rubysec/ruby-advisory-db": { cve: "2017-9050", cvss_v3: 7.5, date: "2017-09-19", description: "The version of libxml2 packaged with Nokogiri contains several\nvulnerabilities. Nokogiri has mitigated these issues by upgrading to\nlibxml 2.9.5.\n\nIt was discovered that a type confusion error existed in libxml2. An\nattacker could use this to specially construct XML data that\ncould cause a denial of service or possibly execute arbitrary\ncode. (CVE-2017-0663)\n\nIt was discovered that libxml2 did not properly validate parsed entity\nreferences. An attacker could use this to specially construct XML\ndata that could expose sensitive information. (CVE-2017-7375)\n\nIt was discovered that a buffer overflow existed in libxml2 when\nhandling HTTP redirects. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-7376)\n\nMarcel Böhme and Van-Thuan Pham discovered a buffer overflow in\nlibxml2 when handling elements. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-9047)\n\nMarcel Böhme and Van-Thuan Pham discovered a buffer overread\nin libxml2 when handling elements. An attacker could use this\nto specially construct XML data that could cause a denial of\nservice. (CVE-2017-9048)\n\nMarcel Böhme and Van-Thuan Pham discovered multiple buffer overreads\nin libxml2 when handling parameter-entity references. An attacker\ncould use these to specially construct XML data that could cause a\ndenial of service. (CVE-2017-9049, CVE-2017-9050)\n", gem: "nokogiri", ghsa: "8c56-cpmw-89x7", patched_versions: [ ">= 1.8.1", ], related: { cve: [ "2017-0663", "2017-7375", "2017-7376", "2017-9047", "2017-9048", "2017-9049", "2017-9050", ], url: [ "https://usn.ubuntu.com/usn/usn-3424-1/", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html", "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html", ], }, title: "Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities", url: "https://github.com/sparklemotion/nokogiri/issues/1673", }, "gitlab.com": { advisories: [ { affected_range: "=2.9.4", affected_versions: "Version 2.9.4", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:N/A:P", cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", cwe_ids: [ "CWE-1035", "CWE-125", "CWE-937", ], date: "2021-06-29", description: "libxml2 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", fixed_versions: [], identifier: "CVE-2017-9050", identifiers: [ "CVE-2017-9050", ], not_impacted: "", package_slug: "gem/nokogiri", pubdate: "2017-05-18", solution: "Unfortunately, there is no solution available yet.", title: "Out-of-bounds Read", urls: [ "https://nvd.nist.gov/vuln/detail/CVE-2017-9050", "http://www.openwall.com/lists/oss-security/2017/05/15/1", "http://www.securityfocus.com/bid/98568", "http://www.debian.org/security/2017/dsa-3952", "https://security.gentoo.org/glsa/201711-01", "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", ], uuid: "9d3f402d-e0ee-46d5-9d33-5abc9d2a3b21", }, { affected_range: "[2.9.4]", affected_versions: "Version 2.9.4", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:N/A:P", cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", cwe_ids: [ "CWE-1035", "CWE-125", "CWE-937", ], date: "2021-06-29", description: "libxml2 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", fixed_versions: [], identifier: "CVE-2017-9050", identifiers: [ "CVE-2017-9050", ], not_impacted: "", package_slug: "nuget/libxml2", pubdate: "2017-05-18", solution: "Unfortunately, there is no solution available yet.", title: "Out-of-bounds Read", urls: [ "https://nvd.nist.gov/vuln/detail/CVE-2017-9050", ], uuid: "e53a6578-38b7-4a4b-a368-39c056855a4c", }, ], }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:xmlsoft:libxml2:2.9.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2017-9050", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "CWE-125", }, ], }, ], }, references: { reference_data: [ { name: "http://www.openwall.com/lists/oss-security/2017/05/15/1", refsource: "MISC", tags: [ "Exploit", "Mailing List", "Patch", "Third Party Advisory", ], url: "http://www.openwall.com/lists/oss-security/2017/05/15/1", }, { name: "98568", refsource: "BID", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/98568", }, { name: "DSA-3952", refsource: "DEBIAN", tags: [], url: "http://www.debian.org/security/2017/dsa-3952", }, { name: "GLSA-201711-01", refsource: "GENTOO", tags: [], url: "https://security.gentoo.org/glsa/201711-01", }, { name: "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", refsource: "MLIST", tags: [], url: "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", }, { name: "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", refsource: "MLIST", tags: [], url: "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", }, ], }, }, impact: { baseMetricV2: { acInsufInfo: true, cvssV2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", userInteractionRequired: false, }, baseMetricV3: { cvssV3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, exploitabilityScore: 3.9, impactScore: 3.6, }, }, lastModifiedDate: "2021-06-29T15:15Z", publishedDate: "2017-05-18T06:29Z", }, }, }
cve-2017-9050
Vulnerability from cvelistv5
Published
2017-05-18 06:13
Modified
2024-08-05 16:55
Severity ?
EPSS score ?
Summary
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/98568 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2017/dsa-3952 | vendor-advisory, x_refsource_DEBIAN | |
| https://security.gentoo.org/glsa/201711-01 | vendor-advisory, x_refsource_GENTOO | |
| http://www.openwall.com/lists/oss-security/2017/05/15/1 | x_refsource_MISC | |
| https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E | mailing-list, x_refsource_MLIST | |
| https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E | mailing-list, x_refsource_MLIST |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T16:55:21.957Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "98568", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/98568", }, { name: "DSA-3952", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "http://www.debian.org/security/2017/dsa-3952", }, { name: "GLSA-201711-01", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "https://security.gentoo.org/glsa/201711-01", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2017/05/15/1", }, { name: "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", }, { name: "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2017-05-18T00:00:00", descriptions: [ { lang: "en", value: "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2021-06-29T14:07:42", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "98568", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/98568", }, { name: "DSA-3952", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "http://www.debian.org/security/2017/dsa-3952", }, { name: "GLSA-201711-01", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "https://security.gentoo.org/glsa/201711-01", }, { tags: [ "x_refsource_MISC", ], url: "http://www.openwall.com/lists/oss-security/2017/05/15/1", }, { name: "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", }, { name: "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2017-9050", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "98568", refsource: "BID", url: "http://www.securityfocus.com/bid/98568", }, { name: "DSA-3952", refsource: "DEBIAN", url: "http://www.debian.org/security/2017/dsa-3952", }, { name: "GLSA-201711-01", refsource: "GENTOO", url: "https://security.gentoo.org/glsa/201711-01", }, { name: "http://www.openwall.com/lists/oss-security/2017/05/15/1", refsource: "MISC", url: "http://www.openwall.com/lists/oss-security/2017/05/15/1", }, { name: "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", }, { name: "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2017-9050", datePublished: "2017-05-18T06:13:00", dateReserved: "2017-05-18T00:00:00", dateUpdated: "2024-08-05T16:55:21.957Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.