CVE-2017-9047

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

• CWE-119

• http://www.debian.org/security/2017/dsa-3952
• http://www.openwall.com/lists/oss-security/2017/05/15/1Exploit, Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/98599Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.gentoo.org/glsa/201711-01
• http://www.debian.org/security/2017/dsa-3952
• http://www.openwall.com/lists/oss-security/2017/05/15/1Exploit, Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/98599Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.gentoo.org/glsa/201711-01

Published

May 18, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9041GNU Binutils 2.28 allows remote attackers to cause a denial …
• CVE-2017-9042readelf.c in GNU Binutils 2017-04-12 has a "cannot be repres…
• CVE-2017-9043readelf.c in GNU Binutils 2017-04-12 has a "shift exponent t…
• CVE-2017-9044The print_symbol_for_build_attribute function in readelf.c i…
• CVE-2017-9045The Google I/O 2017 application before 5.1.4 for Android dow…
• CVE-2017-9046winpm-32.exe in Pegasus Mail (aka Pmail) v4.72 build 572 all…
• CVE-2017-9048libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack…7.5
• CVE-2017-9049libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-…7.5
• CVE-2017-9050libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-…7.5
• CVE-2017-9051libav before 12.1 is vulnerable to an invalid read of size 1…
• CVE-2017-9052An issue, also known as DW201703-006, was discovered in libd…9.8
• CVE-2017-9053An issue, also known as DW201703-005, was discovered in libd…9.1