Lucene search

K
ubuntuUbuntuUSN-3424-1
HistorySep 19, 2017 - 12:00 a.m.

libxml2 vulnerabilities

2017-09-1900:00:00
ubuntu.com
40

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.341 Low

EPSS

Percentile

97.0%

Releases

  • Ubuntu 17.04
  • Ubuntu 16.04 ESM
  • Ubuntu 14.04 ESM

Packages

  • libxml2 - GNOME XML library

Details

It was discovered that a type confusion error existed in libxml2. An
attacker could use this to specially construct XML data that
could cause a denial of service or possibly execute arbitrary
code. (CVE-2017-0663)

It was discovered that libxml2 did not properly validate parsed entity
references. An attacker could use this to specially construct XML
data that could expose sensitive information. (CVE-2017-7375)

It was discovered that a buffer overflow existed in libxml2 when
handling HTTP redirects. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-7376)

Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
libxml2 when handling elements. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-9047)

Marcel Böhme and Van-Thuan Pham discovered a buffer overread
in libxml2 when handling elements. An attacker could use this
to specially construct XML data that could cause a denial of
service. (CVE-2017-9048)

Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
in libxml2 when handling parameter-entity references. An attacker
could use these to specially construct XML data that could cause a
denial of service. (CVE-2017-9049, CVE-2017-9050)

OSVersionArchitecturePackageVersionFilename
Ubuntu17.04noarchlibxml2< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Ubuntu17.04noarchlibxml2-dbg< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Ubuntu17.04noarchlibxml2-dbgsym< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Ubuntu17.04noarchlibxml2-dev< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Ubuntu17.04noarchlibxml2-dev-dbgsym< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Ubuntu17.04noarchlibxml2-doc< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Ubuntu17.04noarchlibxml2-udeb< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Ubuntu17.04noarchlibxml2-udeb-dbgsym< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Ubuntu17.04noarchlibxml2-utils< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Ubuntu17.04noarchlibxml2-utils-dbg< 2.9.4+dfsg1-2.2ubuntu0.1UNKNOWN
Rows per page:
1-10 of 411

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.341 Low

EPSS

Percentile

97.0%