CVE-2017-9049

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

• CWE-125
• CWE-125

• http://www.debian.org/security/2017/dsa-3952
• http://www.openwall.com/lists/oss-security/2017/05/15/1Exploit, Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/98601Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.gentoo.org/glsa/201711-01
• http://www.debian.org/security/2017/dsa-3952
• http://www.openwall.com/lists/oss-security/2017/05/15/1Exploit, Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/98601Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.gentoo.org/glsa/201711-01

Published

May 18, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9043readelf.c in GNU Binutils 2017-04-12 has a "shift exponent t…
• CVE-2017-9044The print_symbol_for_build_attribute function in readelf.c i…
• CVE-2017-9045The Google I/O 2017 application before 5.1.4 for Android dow…
• CVE-2017-9046winpm-32.exe in Pegasus Mail (aka Pmail) v4.72 build 572 all…
• CVE-2017-9047A buffer overflow was discovered in libxml2 20904-GITv2.9.4-…
• CVE-2017-9048libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack…7.5
• CVE-2017-9050libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-…7.5
• CVE-2017-9051libav before 12.1 is vulnerable to an invalid read of size 1…
• CVE-2017-9052An issue, also known as DW201703-006, was discovered in libd…9.8
• CVE-2017-9053An issue, also known as DW201703-005, was discovered in libd…9.1
• CVE-2017-9054An issue, also known as DW201703-002, was discovered in libd…9.8
• CVE-2017-9055An issue, also known as DW201703-001, was discovered in libd…9.8