GCVE - cpe:2.3:a:xmlsoft:libxml2:2.9.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:xmlsoft:libxml2:2.9.4:*:*:*:*:*:*:*

part: a version: 2.9.4 update: *

Vendor	Xmlsoft (`be3c3366-cde4-54a5-8785-eb1f04df6881`)
Product	Libxml2 (`b6949b35-db17-5df6-ad91-0baa70a48eb5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/libxml2`	purl2cpe	2026-06-01 10:12:19.602960
`pkg:deb/ubuntu/libxml2`	purl2cpe	2026-06-01 10:12:19.602962
`pkg:github/gnome/libxml2`	purl2cpe	2026-06-01 10:12:19.602963
`pkg:gitlab/redhat/libxml2`	purl2cpe	2026-06-01 10:12:19.602964
`pkg:rpm/fedora/libxml2`	purl2cpe	2026-06-01 10:12:19.602966
`pkg:rpm/opensuse/libxml2`	purl2cpe	2026-06-01 10:12:19.602967

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-9050`	vulnerable	2026-06-08 05:10:09.292463	Details available libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839. Published: 2017-05-18T06:13:00.000Z Updated: 2025-12-17T22:10:56.955Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/98568 http://www.debian.org/security/2017/dsa-3952 https://security.gentoo.org/glsa/201711-01 http://www.openwall.com/lists/oss-security/2017/05/15/1 https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9049`	vulnerable	2026-06-08 05:10:09.291787	Details available libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398. Published: 2017-05-18T06:13:00.000Z Updated: 2025-12-18T14:20:32.345Z Open on db.gcve.eu Reference links http://www.debian.org/security/2017/dsa-3952 https://security.gentoo.org/glsa/201711-01 http://www.openwall.com/lists/oss-security/2017/05/15/1 http://www.securityfocus.com/bid/98601 https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9048`	vulnerable	2026-06-08 05:10:09.291213	Details available libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash. Published: 2017-05-18T06:13:00.000Z Updated: 2025-12-18T11:40:50.027Z Open on db.gcve.eu Reference links http://www.debian.org/security/2017/dsa-3952 https://security.gentoo.org/glsa/201711-01 http://www.openwall.com/lists/oss-security/2017/05/15/1 http://www.securityfocus.com/bid/98556 https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9047`	vulnerable	2026-06-08 05:10:09.290612	Details available A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash. Published: 2017-05-18T06:13:00.000Z Updated: 2024-08-05T16:55:21.859Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/98599 http://www.debian.org/security/2017/dsa-3952 https://security.gentoo.org/glsa/201711-01 http://www.openwall.com/lists/oss-security/2017/05/15/1 https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-8872`	vulnerable	2026-06-08 05:10:09.024320	Details available The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure. Published: 2017-05-10T05:14:00.000Z Updated: 2025-12-17T21:59:08.413Z Open on db.gcve.eu Reference links https://bugzilla.gnome.org/show_bug.cgi?id=775200 https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-5969`	vulnerable	2026-06-08 05:09:50.200322	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.