CVE-2017-7376
libxml2: Incorrect limit used for port values
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium), Red Hat (low).
Description
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 7 | libxml2 | 2.8.0+dfsg1-7+wheezy9 |
| debian 8 | libxml2 | 2.9.1+dfsg1-5+deb8u5 |
| debian 9 | libxml2 | 2.9.4+dfsg1-2.2+deb9u1 |
| echo | libxml2, libxml2-2.9.1 | 2.9.4+dfsg1-3.1 and 1 more |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| ubuntu 14.04 | libxml2 | 2.9.1+dfsg1-3ubuntu4.10 |
Show all 17 entries from 16 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 7 | libxml2 | 2.8.0+dfsg1-7+wheezy9 |
| debian 8 | libxml2 | 2.9.1+dfsg1-5+deb8u5 |
| debian 9 | libxml2 | 2.9.4+dfsg1-2.2+deb9u1 |
| echo | libxml2 | 2.9.4+dfsg1-3.1 |
| echo | libxml2-2.9.1 | 2.9.1+e1 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| ubuntu 14.04 | libxml2 | 2.9.1+dfsg1-3ubuntu4.10 |
| ubuntu 14.04-ESM | libxml2 | 2.9.1+dfsg1-3ubuntu4.10 |
| ubuntu 16.04 | libxml2 | 2.9.3+dfsg1-1ubuntu0.3 |
| ubuntu 16.04-ESM | libxml2 | 2.9.3+dfsg1-1ubuntu0.3 |
| ubuntu 17.04 | libxml2 | 2.9.4+dfsg1-2.2ubuntu0.1 |
References
- http://www.securityfocus.com/bid/98877
- http://www.securitytracker.com/id/1038623
- https://access.redhat.com/security/cve/CVE-2017-7376
- https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4
- https://bugzilla.redhat.com/show_bug.cgi?id=1462216
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://git.gnome.org/browse/libxml2/commit/?id=5dca9eea1bd4263bfa4d037ab2443de1cd730f7e
- https://nvd.nist.gov/vuln/detail/CVE-2017-7376