IM
IronMonkey Threat Research

CVE-2017-7376 CRITICAL

Published: 2018-02-19 | Last Modified: 2026-06-17 | Status: Modified

Description

Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.

Additional Descriptions (1)

Desbordamiento de búfer en libxml2 permite que atacantes remotos ejecuten código arbitrario aprovechando un límite incorrecto para los valores del puerto cuando se gestionan las redirecciones.

CVSS Metrics

Base Score: 10.0 (HIGH)

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactCOMPLETE
Integrity ImpactCOMPLETE
Availability ImpactCOMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 10.0

Weaknesses

Source Type Description
[email protected] Primary
en CWE-119

Affected Products

Vendor Product Version Update Type
xmlsoft libxml2 * <built-in method update of dict object at 0x7fd340b02bc0> Application
google android 4.4.4 <built-in method update of dict object at 0x7fd34b8daa00> Operating System
google android 5.0.2 <built-in method update of dict object at 0x7fd340b03040> Operating System
google android 5.1.1 <built-in method update of dict object at 0x7fd369ef4c80> Operating System
google android 6.0 <built-in method update of dict object at 0x7fd340b02880> Operating System
google android 6.0.1 <built-in method update of dict object at 0x7fd340b02580> Operating System
google android 7.0 <built-in method update of dict object at 0x7fd34b8d8ac0> Operating System
google android 7.1.1 <built-in method update of dict object at 0x7fd34b8dbe80> Operating System
google android 7.1.2 <built-in method update of dict object at 0x7fd340ac8440> Operating System
debian debian_linux 8.0 <built-in method update of dict object at 0x7fd340b02cc0> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd36b89f240> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

References