https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:27:58 +0000 https://vulnerability.circl.lu/vuln/cve-2017-9047 <p>A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer &#39;buf&#39; of size &#39;size&#39;. The variable len is assigned strlen(buf). If the content-&gt;type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content-&gt;prefix is appended to buf (if it actually fits) whereupon (ii) content-&gt;name is written to the buffer. However, the check for whether the content-&gt;name actually fits also uses &#39;len&#39; rather than the updated buffer length strlen(buf). This allows us to write about &#34;size&#34; many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p> <p>A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer &#39;buf&#39; of size &#39;size&#39;. The variable len is assigned strlen(buf). If the content-&gt;type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content-&gt;prefix is appended to buf (if it actually fits) whereupon (ii) content-&gt;name is written to the buffer. However, the check for whether the content-&gt;name actually fits also uses &#39;len&#39; rather than the updated buffer length strlen(buf). This allows us to write about &#34;size&#34; many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p> https://vulnerability.circl.lu/vuln/cve-2017-9047