CVE-2017-18926: Buffer Overflow
raptorxmlwriterstartelementcommon in raptorxmlwriter.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptorqnameformatasxml).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/raptor2to a version that resolves this vulnerability.Fixed in 2.0.14-1.1~deb10u2Fixed in 2.0.14-1.1~deb10u1Fixed in 2.0.14-1.2Fixed in 2.0.15-4Fixed in 2.0.16-3 - Upgrade
Upgrade
alpine/raptor2to a version that resolves this vulnerability.Fixed in 2.0.15-r2 - Upgrade
Upgrade
Raptor RDF Syntax Libraryto a version that resolves this vulnerability.Patch 0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2017-18926.
What is the title of the vulnerability?
The title of the vulnerability is 'raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15'.
What is the severity of CVE-2017-18926?
The severity of CVE-2017-18926 is high with a severity value of 7.1.
What software is affected by CVE-2017-18926?
The affected software includes Raptor RDF Syntax Library 2.0.15, Debian Debian Linux 9.0 and 10.0, and Fedoraproject Fedora 31, 32, and 33.
How can the CVE-2017-18926 vulnerability be fixed?
To fix CVE-2017-18926, update the affected Raptor RDF Syntax Library version to 2.0.16-3 or apply the corresponding security patches provided by the software vendor.