CVE-2017-5130

Vulnerability

An integer overflow vulnerability exists in the xmlmemory.c file of libxml2 prior to version 2.9.5. This flaw allows a remote attacker to cause heap corruption by providing a specially crafted XML file. The vulnerable library is used by Google Chrome (prior to 62.0.3202.62) and other products [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious XML file that triggers an integer overflow when parsed by libxml2. No special authentication or user interaction beyond opening the file (e.g., via a web page in Chrome) is required. The attacker only needs to deliver the malicious file to the target, which can be done through a web page or other means [1][2].

Impact

Successful exploitation leads to heap corruption, which can be leveraged by an attacker to execute arbitrary code, crash the application, or obtain sensitive information. The redhat advisory lists the severity as Important, with potential for arbitrary code execution [1][2].

Mitigation

Google Chrome was fixed in version 62.0.3202.62 [1][2]. The Gentoo advisory recommends upgrading to >=www-client/chromium-62.0.3202.62 or >=www-client/google-chrome-62.0.3202.62 [2]. The underlying libxml2 library is fixed in version 2.9.5 [3]. Users should update affected products to these versions. No workaround is available [2].