FreeBSD : libxml2 -- Multiple Issues (76e59f55-4f7a-4887-bcb0-11604004163a)

Medium Nessus Plugin ID 105216

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 6.0

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

libxml2 developers report :

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about 'size' many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash.
This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash.
This vulnerability exists because of an incomplete fix for CVE-2016-1839.

Solution

Update the affected package.

See Also

https://bugzilla.gnome.org/show_bug.cgi?id=775200

https://www.openwall.com/lists/oss-security/2017/05/15/1

https://www.securityfocus.com/bid/98599

https://www.openwall.com/lists/oss-security/2017/05/15/1

https://www.securityfocus.com/bid/98556

https://www.openwall.com/lists/oss-security/2017/05/15/1

https://www.securityfocus.com/bid/98601

https://www.openwall.com/lists/oss-security/2017/05/15/1

https://www.securityfocus.com/bid/98568

http://www.nessus.org/u?fff120c8

Plugin Details

Severity: Medium

ID: 105216

File Name: freebsd_pkg_76e59f554f7a4887bcb011604004163a.nasl

Version: 3.4

Type: local

Published: 2017/12/14

Updated: 2018/11/21

Dependencies: 12634

Risk Information

Risk Factor: Medium

VPR Score: 6.0

CVSS v2.0

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS v3.0

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:libxml2, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2017/12/13

Vulnerability Publication Date: 2017/05/10

Reference Information

CVE: CVE-2017-8872, CVE-2017-9047, CVE-2017-9048, CVE-2017-9049, CVE-2017-9050