CVE-2017-9048

Name	CVE-2017-9048
Description	libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1008-1, DSA-3952-1
Debian Bugs	863021

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libxml2 (PTS)	buster	2.9.4+dfsg1-7+deb10u4	fixed
	buster (security)	2.9.4+dfsg1-7+deb10u6	fixed
	bullseye (security), bullseye	2.9.10+dfsg-6.7+deb11u4	fixed
	bookworm	2.9.14+dfsg-1.3~deb12u1	fixed
	trixie, sid	2.9.14+dfsg-1.3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libxml2	source	wheezy	2.8.0+dfsg1-7+wheezy8	DLA-1008-1
libxml2	source	jessie	2.9.1+dfsg1-5+deb8u5	DSA-3952-1
libxml2	source	stretch	2.9.4+dfsg1-2.2+deb9u1	DSA-3952-1
libxml2	source	(unstable)	2.9.4+dfsg1-3.1		863021

Notes

https://bugzilla.gnome.org/show_bug.cgi?id=781701 (not public)
https://www.openwall.com/lists/oss-security/2017/05/15/1
Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/932cc9896ab41475d4aa429c27d9afd175959d74