CVE-2017-18258
N/A
Published: April 8, 2018 at 05:00 PM UTC
Updated: October 14, 2026 at 07:16 AM UTC
2 products affected across 2 vendorsLIBXML2LIBXML2
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 3%
Description
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (7)
x_refsource_MISCPatchVendor Advisory
Source: [email protected]
https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bbx_refsource_CONFIRM
Source: [email protected]
https://kc.mcafee.com/corporate/index?page=content&id=SB10284Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2018/09/msg00035.htmlMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2020/09/msg00009.htmlx_refsource_CONFIRM
Source: [email protected]
https://security.netapp.com/advisory/ntap-20190719-0001/Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlQuick Info
StatusMODIFIED
CWE
CWE-770
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card