Denial of Service Vulnerability in libxml2: CVE-2017-8872
Summary
UBUNTU-CVE-2017-8872: The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure. Affects libxml2 versions < 2.9.1+dfsg1-3ubuntu4.13+esm2. Fixed in 2.9.1+dfsg1-3ubuntu4.13+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides a range of functionalities for processing XML and HTML documents. It is known for its efficiency and is utilized in various applications and systems for data manipulation. However, libxml2 has been found to be vulnerable to a specific issue that can lead to denial of service and information disclosure.
Vulnerability Detail
The vulnerability identified as CVE-2017-8872 arises from the htmlParseTryOrFinish function in HTMLparser.c within libxml2 version 2.9.4. This flaw allows attackers to exploit the library by causing a buffer over-read, which can lead to a denial of service or the potential disclosure of sensitive information. The severity of this vulnerability is underscored by its CVSS score of 9.1, indicating a high level of risk.
How To Fix
Minimum fixed version
2.9.1+dfsg1-3ubuntu4.13+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted HTML content with libxml2 until the package is updated to a secure version. This can help mitigate the risk of exploitation.
Conclusion
The CVE-2017-8872 vulnerability in libxml2 poses a significant risk due to its potential for denial of service and information disclosure. Users are strongly advised to update their libxml2 packages to the latest patched versions to ensure their systems remain secure.
See every vulnerability recorded for libxml2 →
FAQ
CVE-2017-8872 is a vulnerability in the libxml2 library that allows for denial of service and potential information disclosure due to a buffer over-read.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes and the potential exposure of sensitive data, posing significant risks to users and systems.
Yes, a patched version of libxml2 is available. Users should update to version 2.9.4+dfsg1-6.1ubuntu1 or later to mitigate the risk.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It helps developers stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
