CVE-2017-9048

Name of the Vulnerable Software and Affected Versions libxml2 version 20904-GITv2.9.4-16-g0741801

Description The issue is related to a stack-based buffer overflow in the xmlSnprintfElementContent function in valid.c. This function is supposed to recursively dump the element content definition into a char buffer buf of size size. However, at the end of the routine, it may concatenate two more characters without checking whether the current strlen(buf) + 2 < size. This can cause programs that use libxml2, such as PHP, to crash. The vulnerability is associated with a buffer overflow in memory, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For libxml2 version 20904-GITv2.9.4-16-g0741801, as a temporary workaround, consider disabling the xmlSnprintfElementContent function until a patch is available. Restrict access to the valid.c module to minimize the risk of exploitation. Avoid using the xmlSnprintfElementContent function in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.