CVE-2017-18258: Medium severity Xmlsoft Libxml2 vulnerability
A flaw was found in libxml2 before 2.9.6. The xzhead function in xzlib.c in allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
References: https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb
Other sources
The xzhead function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/nokogirito a version that resolves this vulnerability.Fixed in 1.8.2 - Upgrade
Upgrade
redhat/libxml2to a version that resolves this vulnerability.Fixed in 0:2.9.1-6.el7.4 - Upgrade
Upgrade
redhat/libxml2to a version that resolves this vulnerability.Fixed in 2.9.6 - Upgrade
Upgrade
debian/libxml2to a version that resolves this vulnerability.Fixed in 2.9.14+dfsg-1.3~deb12u6Fixed in 2.9.14+dfsg-1.3~deb12u4Fixed in 2.12.7+dfsg+really2.9.14-2.1+deb13u3Fixed in 2.12.7+dfsg+really2.9.14-2.1+deb13u1Fixed in 2.15.4+dfsg-1 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.9.6
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2017-18258?
CVE-2017-18258 is a vulnerability in libxml2 that allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file.
Which software is affected by CVE-2017-18258?
The software affected by CVE-2017-18258 includes Nokogiri (version 1.8.2), libxml2 (versions 2.9.1+dfsg1-3ubuntu4.13, 2.9.4+dfsg1-6.1ubuntu1.2, 2.9.6, 2.9.3+dfsg1-1ubuntu0.6), and libxml2 (versions 2.9.4+dfsg1-7+deb10u4, 2.9.4+dfsg1-7+deb10u6, 2.9.10+dfsg-6.7+deb11u4, 2.9.14+dfsg-1.3~deb12u1, 2.9.14+dfsg-1.3).
What is the severity of CVE-2017-18258?
The severity of CVE-2017-18258 is medium with a CVSS score of 6.5.
How do I fix CVE-2017-18258?
To fix CVE-2017-18258, you should update libxml2 to version 2.9.6 or apply the necessary patches provided by the software vendor.
Where can I find more information about CVE-2017-18258?
You can find more information about CVE-2017-18258 at the following references: [Git Repository](https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb), [Ubuntu Security Notice](https://usn.ubuntu.com/3739-1/), [Debian Security Advisory](https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html).