PublicDateAtUSN: 2017-05-18
Candidate: CVE-2017-9049
PublicDate: 2017-05-18 06:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9049
 http://www.openwall.com/lists/oss-security/2017/05/15/1
 https://ubuntu.com/security/notices/USN-3424-1
 https://ubuntu.com/security/notices/USN-3424-2
Description:
 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer
 over-read in the xmlDictComputeFastKey function in dict.c. This
 vulnerability causes programs that use libxml2, such as PHP, to crash. This
 vulnerability exists because of an incomplete fix for libxml2 Bug 759398.
Ubuntu-Description:
Notes:
 mdeslaur> probably same issue as CVE-2017-9050
Bugs:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863019
 https://bugzilla.gnome.org/show_bug.cgi?id=781205
Priority: medium
Discovered-by: Marcel Böhme and Van-Thuan Pham
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_libxml2:
 upstream: https://git.gnome.org/browse/libxml2/commit/?id=e26630548e7d138d2c560844c43820b6767251e3
upstream_libxml2: released (2.9.4+dfsg1-3.1)
precise/esm_libxml2: released (2.7.8.dfsg-5.1ubuntu4.18)
trusty_libxml2: released (2.9.1+dfsg1-3ubuntu4.10)
trusty/esm_libxml2: released (2.9.1+dfsg1-3ubuntu4.10)
vivid/stable-phone-overlay_libxml2: ignored (reached end-of-life)
vivid/ubuntu-core_libxml2: DNE
xenial_libxml2: released (2.9.3+dfsg1-1ubuntu0.3)
esm-infra/xenial_libxml2: released (2.9.3+dfsg1-1ubuntu0.3)
yakkety_libxml2: ignored (reached end-of-life)
zesty_libxml2: released (2.9.4+dfsg1-2.2ubuntu0.1)
devel_libxml2: not-affected (2.9.4+dfsg1-3.1)