CVE Feed

    Dashboard / CVE / CVE-2017-9050

    CVE-2017-9050

    libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

    Published:May 15, 2017
    Last Modified:Dec 17, 2025
    EPS:May 18, 2017
    EPSS Score:0.00359
    CVSS Score:7.5

    Affected Products

    Vendor
    Redhat
    Product
    Jboss Core Services
    Vendor
    Xmlsoft
    Product
    Libxml2

    Exploits

    http://www.openwall.com/lists/oss-security/2017/05/15/1http://www.openwall.com/lists/oss-security/2017/05/15/1

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers
    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-6732 (CVSS 6.5) — A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Sche…
    CVE-2026-3234 (CVSS 4.3) — A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in th…
    CVE-2026-1757 (CVSS 6.2) — A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memo…
    CVE-2026-0992 (CVSS 2.9) — A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when proc…
    CVE-2026-0990 (CVSS 5.9) — A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the x…
    CVE-2026-0989 (CVSS 3.7) — A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. …
    CVE-2025-6170 (CVSS 2.5) — A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a…
    CVE-2025-6021 (CVSS 7.5) — A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can …
    CVE-2025-49795 (CVSS 7.5) — A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw…
    CVE-2025-49796 (CVSS 9.1) — A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger…

    References

    http://www.debian.org/security/2017/dsa-3952
    http://www.openwall.com/lists/oss-security/2017/05/15/1
    http://www.securityfocus.com/bid/98568
    https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
    https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
    https://security.gentoo.org/glsa/201711-01
    http://www.debian.org/security/2017/dsa-3952
    http://www.openwall.com/lists/oss-security/2017/05/15/1
    http://www.securityfocus.com/bid/98568
    https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
    https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
    https://security.gentoo.org/glsa/201711-01

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High