CVE-2017-9047

Name of the Vulnerable Software and Affected Versions libxml2 version 20904-GITv2.9.4-16-g0741801

Description A buffer overflow issue was discovered in the xmlSnprintfElementContent function, which can cause programs using libxml2, such as PHP, to crash. The problem arises when the function attempts to recursively dump element content into a char buffer buf of size size. The variable len is assigned the value of strlen(buf), but the check for whether the content fits in the buffer uses the outdated len value instead of the updated buffer length strlen(buf). This allows writing beyond the allocated memory, potentially leading to a crash. The issue can be exploited by a remote attacker to cause a denial of service.

Recommendations For libxml2 version 20904-GITv2.9.4-16-g0741801, consider disabling the xmlSnprintfElementContent function until a patch is available to prevent potential crashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.