CVE-2017-5130 An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a cr...
HighCVSS 8.8
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxml2(Debian:12) | < 2.9.4+dfsg1-5.1 | 2.9.4+dfsg1-5.1 |
| debian/libxml2(Debian:13) | < 2.9.4+dfsg1-5.1 | 2.9.4+dfsg1-5.1 |
| debian/libxml2(Debian:14) | < 2.9.4+dfsg1-5.1 | 2.9.4+dfsg1-5.1 |
| Google Chrome | < 62.0.3202.62 | 62.0.3202.62 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| xmlsoft libxml2 | < 2.9.5 | 2.9.5 |
References
- Debian Security Tracker CVE-2017-5130 vendor-advisory
- bugzilla.gnome.org issue-tracking
- 101482 third-party-advisory vdb-entry
- RHSA-2017:2997 third-party-advisory vendor-advisory
- chromereleases.googleblog.com vendor-advisory
- crbug.com third-party-advisory
- git.gnome.org third-party-advisory
- [debian-lts-announce] 20171123 [SECURITY] [DLA 1188-1] libxml2 security update mailing-list third-party-advisory
- [debian-lts-announce] 20220408 [SECURITY] [DLA 2972-1] libxml2 security update mailing-list
- GLSA-201710-24 third-party-advisory vendor-advisory
- security.netapp.com
- www.oracle.com
- bugs.debian.org issue-tracking