Skip to content
OpenAdvisories
Critical USN-3424-1 7 CVEs

libxml2 vulnerabilities

Published Sep 19, 2017 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that a type confusion error existed in libxml2. An
attacker could use this to specially construct XML data that
could cause a denial of service or possibly execute arbitrary
code. (CVE-2017-0663)

It was discovered that libxml2 did not properly validate parsed entity
references. An attacker could use this to specially construct XML
data that could expose sensitive information. (CVE-2017-7375)

It was discovered that a buffer overflow existed in libxml2 when
handling HTTP redirects. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-7376)

Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
libxml2 when handling elements. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-9047)

Marcel Böhme and Van-Thuan Pham discovered a buffer overread
in libxml2 when handling elements. An attacker could use this
to specially construct XML data that could cause a denial of
service. (CVE-2017-9048)

Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
in libxml2 when handling parameter-entity references. An attacker
could use these to specially construct XML data that could cause a
denial of service. (CVE-2017-9049, CVE-2017-9050)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS libxml2 2.9.1+dfsg1-3ubuntu4.10
Ubuntu · 16.04 LTS 16.04:LTS libxml2 2.9.3+dfsg1-1ubuntu0.3

Vulnerabilities 7

  • Critical 9.8
    CVE-2017-7375

    A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request e…

    libxml2 libxml2 Debian Ubuntu
  • High 7.5
    CVE-2017-9048

    libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementCont…

    libxml2 libxml2 Debian Ubuntu
  • High 7.5
    CVE-2017-9049

    libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey functio…

    libxml2 libxml2 Debian Ubuntu
  • High 7.5
    CVE-2017-9050

    Out-of-bounds read in nokogiri

    libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix f…

    libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  • Unscored —
    CVE-2017-0663

    A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arb…

    Google Android android libxml2 Android Debian Ubuntu
  • Unscored —
    CVE-2017-7376 Public exploit EPSS 23%

    Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port …

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2017-9047

    A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in vali…

    libxml2 libxml2 Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2017-0663
  • report
    https://ubuntu.com/security/CVE-2017-7375
  • report
    https://ubuntu.com/security/CVE-2017-7376
  • report
    https://ubuntu.com/security/CVE-2017-9047
  • report
    https://ubuntu.com/security/CVE-2017-9048
  • report
    https://ubuntu.com/security/CVE-2017-9049
  • report
    https://ubuntu.com/security/CVE-2017-9050