{"id":"CVE-2017-18258","aliases":["DEBIAN-CVE-2017-18258","DLA-1524-1","DLA-2369-1","EUVD-2018-0189","GHSA-882p-jqgm-f45g","RHSA-2020:1190","SUSE-SU-2018:3081-1","UBUNTU-CVE-2017-18258","USN-3739-1"],"status":"published","title":"Uncontrolled resource consumption in nokogiri","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02729,"percentile":0.86176,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2018-04-08T00:00:00Z","modified":"2026-10-24T10:30:43Z","fixes":[{"ecosystem":"RubyGems","package":"nokogiri","fixed_in":["1.8.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","fixed_in":["2.9.1+dfsg1-3ubuntu4.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-5+deb8u7"}]}],"versions":["2.9.1+dfsg1-5","2.9.1+dfsg1-5+deb8u1","2.9.1+dfsg1-5+deb8u2","2.9.1+dfsg1-5+deb8u3","2.9.1+dfsg1-5+deb8u4","2.9.1+dfsg1-5+deb8u5","2.9.1+dfsg1-5+deb8u6"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-2.2+deb9u3"}]}],"versions":["2.9.4+dfsg1-2.2","2.9.4+dfsg1-2.2+deb9u1","2.9.4+dfsg1-2.2+deb9u2"],"bundled":8},{"source":"osv","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.6"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.2"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.6"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.2"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1"],"bundled":5}],"products":[{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://usn.ubuntu.com/3739-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10284","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190719-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18258","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-882p-jqgm-f45g","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-18258.yml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18258","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190719-0001","tags":["web"]},{"url":"https://usn.ubuntu.com/3739-1","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1190","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1277146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1358641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1523128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1619875","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1190.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8035","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5131","tags":["advisory"]},{"url":"https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15412","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15412","tags":["advisory"]},{"url":"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18258","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14404","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14567","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14567","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183081-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1088279","tags":["report"]},{"url":"https://bugzilla.suse.com/1088601","tags":["report"]},{"url":"https://bugzilla.suse.com/1102046","tags":["report"]},{"url":"https://bugzilla.suse.com/1105166","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9251","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-18258","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3739-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14567","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-18258","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.","status":"published","published":"2018-04-08T17:00:00Z","modified":"2026-10-14T06:30:31.242Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2018-0189","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.","status":"published","published":"2018-04-08T17:00:00Z","modified":"2026-10-14T06:30:31Z","updated_at":"2026-11-02T17:27:17.902641Z"}],"ghsa":[{"id":"GHSA-882p-jqgm-f45g","title":"Uncontrolled resource consumption in nokogiri","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.","status":"published","published":"2018-04-13T16:17:46Z","modified":"2023-05-04T19:56:41Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:36:52.310293Z"}],"nvd":[{"id":"CVE-2017-18258","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.","status":"published","published":"2018-04-08T17:29:00.237Z","modified":"2026-10-14T07:16:40.117Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:04:17.032862Z"}],"osv":[{"id":"CVE-2017-18258","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.","status":"published","published":"2018-04-08T17:29:00.237Z","modified":"2026-10-24T10:30:43.23378562Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-18258","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.","status":"published","published":"2018-04-08T17:29:00.237Z","modified":"2026-10-15T07:47:24.227877284Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"GHSA-882p-jqgm-f45g","title":"Uncontrolled resource consumption in nokogiri","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.","status":"published","published":"2018-04-13T16:17:46Z","modified":"2024-02-16T08:04:23.678693Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"RHSA-2020:1190","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2024-09-16T03:18:57Z","modified":"2026-10-14T10:01:18Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2017-18258","description":"The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.","status":"published","published":"2018-04-08T00:00:00Z","modified":"2026-04-22T11:22:15.414491Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DLA-1524-1","title":"libxml2 - security update","status":"published","published":"2018-09-27T00:00:00Z","modified":"2026-03-09T01:21:54.21619Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2369-1","title":"libxml2 - security update","status":"published","published":"2020-09-09T00:00:00Z","modified":"2026-03-09T01:23:38.236188Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"SUSE-SU-2018:3081-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following security issues:\n\n- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause a\n  denial of service (infinite loop) via a crafted XML file that triggers\n  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279).\n- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted XML\n  file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n  (bsc#1105166).\n- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()\n  function when parsing an invalid XPath expression in the XPATH_OP_AND or\n  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046).\n- CVE-2017-18258: The xz_head function allowed remote attackers to cause a\n  denial of service (memory consumption) via a crafted LZMA file, because the\n  decoder functionality did not restrict memory usage to what is required for a\n  legitimate file (bsc#1088601).\n","status":"published","published":"2018-10-09T09:08:27Z","modified":"2026-02-04T04:30:17.005947Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3739-1","title":"libxml2 vulnerabilities","description":"Matias Brutti discovered that libxml2 incorrectly handled certain XML files.\nAn attacker could possibly use this issue to expose sensitive information.\n(CVE-2016-9318)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2017-16932)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2017-18258, CVE-2018-14404, CVE-2018-14567)\n","status":"published","published":"2018-08-14T17:28:27Z","modified":"2026-04-22T09:48:27.757606Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}