libxml2 CVE-2017-9048 Local Stack Buffer Overflow Vulnerability

Bugtraq ID:	98556
Class:	Boundary Condition Error
CVE:	CVE-2017-9048
Remote:	No
Local:	Yes
Published:	May 19 2017 12:00AM
Updated:	Aug 23 2017 08:11AM
Credit:	Marcel Böhme and Van-Thuan Pham of TSUNAMi Security Research Centre
Vulnerable:	XMLSoft Libxml2 2.9.4 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

libxml2 CVE-2017-9048 Local Stack Buffer Overflow Vulnerability

libxml2 is prone to a local stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely cause a denial-of-service condition.

Libxml2 2.9.4 is vulnerable; other versions may also be affected.

libxml2 CVE-2017-9048 Local Stack Buffer Overflow Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

libxml2 CVE-2017-9048 Local Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

libxml2 CVE-2017-9048 Local Stack Buffer Overflow Vulnerability

References:

• libxml2 Homepage (xmlsoft)
  
• Bug 1452549 - (CVE-2017-9048) CVE-2017-9048 libxml2: Stack-based buffer overflow (Redhat)
  
• CVE-2017-9048 (Redhat)
  
• Invalid writes and reads in libxml2 (openwall)