vulnwire
7.5high

CVE-2017-9049

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c.

Published 9 y ago · modified 24 d ago · JSON

CVSS
7.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
4.6%
percentile 92%
Public exploits
0
none known

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
yes
Technical impact
partial
Assessed
10 mo ago

Exploit prediction (EPSS)

4.63% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

References

  • debian.org /security/2017/dsa-3952 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • security.gentoo.org /glsa/201711-01 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • openwall.com /lists/oss-security/2017/05/15/1 · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/98601 · vdb-entry, x_refsource_BID, x_transferred
  • lists.apache.org /thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkee · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkee · mailing-list, x_refsource_MLIST, x_transferred
  • cert-portal.siemens.com /productcert/html/ssa-398330.html

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.