CVE-2017-7376
libxml2: Incorrect limit used for port values
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Ubuntu (orta), Red Hat (düşük).
Açıklama
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 7 | libxml2 | 2.8.0+dfsg1-7+wheezy9 |
| debian 8 | libxml2 | 2.9.1+dfsg1-5+deb8u5 |
| debian 9 | libxml2 | 2.9.4+dfsg1-2.2+deb9u1 |
| echo | libxml2, libxml2-2.9.1 | 2.9.4+dfsg1-3.1 ve 1 tane daha |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| ubuntu 14.04 | libxml2 | 2.9.1+dfsg1-3ubuntu4.10 |
16 kaynaktaki 17 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 7 | libxml2 | 2.8.0+dfsg1-7+wheezy9 |
| debian 8 | libxml2 | 2.9.1+dfsg1-5+deb8u5 |
| debian 9 | libxml2 | 2.9.4+dfsg1-2.2+deb9u1 |
| echo | libxml2 | 2.9.4+dfsg1-3.1 |
| echo | libxml2-2.9.1 | 2.9.1+e1 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| ubuntu 14.04 | libxml2 | 2.9.1+dfsg1-3ubuntu4.10 |
| ubuntu 14.04-ESM | libxml2 | 2.9.1+dfsg1-3ubuntu4.10 |
| ubuntu 16.04 | libxml2 | 2.9.3+dfsg1-1ubuntu0.3 |
| ubuntu 16.04-ESM | libxml2 | 2.9.3+dfsg1-1ubuntu0.3 |
| ubuntu 17.04 | libxml2 | 2.9.4+dfsg1-2.2ubuntu0.1 |
Referanslar
- http://www.securityfocus.com/bid/98877
- http://www.securitytracker.com/id/1038623
- https://access.redhat.com/security/cve/CVE-2017-7376
- https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4
- https://bugzilla.redhat.com/show_bug.cgi?id=1462216
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://git.gnome.org/browse/libxml2/commit/?id=5dca9eea1bd4263bfa4d037ab2443de1cd730f7e
- https://nvd.nist.gov/vuln/detail/CVE-2017-7376