PublicDateAtUSN: 2017-05-18
Candidate: CVE-2017-9050
PublicDate: 2017-05-18 06:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9050
 http://www.openwall.com/lists/oss-security/2017/05/15/1
 https://ubuntu.com/security/notices/USN-3424-1
 https://ubuntu.com/security/notices/USN-3424-2
Description:
 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer
 over-read in the xmlDictAddString function in dict.c. This vulnerability
 causes programs that use libxml2, such as PHP, to crash. This vulnerability
 exists because of an incomplete fix for CVE-2016-1839.
Ubuntu-Description:
Notes:
 mdeslaur> probably same issue as CVE-2017-9049
Bugs:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863018
 https://bugzilla.gnome.org/show_bug.cgi?id=781361
Priority: medium
Discovered-by: Marcel Böhme and Van-Thuan Pham
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_libxml2:
 upstream: https://git.gnome.org/browse/libxml2/commit/?id=e26630548e7d138d2c560844c43820b6767251e3
upstream_libxml2: released (2.9.4+dfsg1-3.1)
precise/esm_libxml2: released (2.7.8.dfsg-5.1ubuntu4.18)
trusty_libxml2: released (2.9.1+dfsg1-3ubuntu4.10)
trusty/esm_libxml2: released (2.9.1+dfsg1-3ubuntu4.10)
vivid/stable-phone-overlay_libxml2: ignored (reached end-of-life)
vivid/ubuntu-core_libxml2: DNE
xenial_libxml2: released (2.9.3+dfsg1-1ubuntu0.3)
esm-infra/xenial_libxml2: released (2.9.3+dfsg1-1ubuntu0.3)
yakkety_libxml2: ignored (reached end-of-life)
zesty_libxml2: released (2.9.4+dfsg1-2.2ubuntu0.1)
devel_libxml2: not-affected (2.9.4+dfsg1-3.1)