CVE-2017-18258
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder funct
Published Apr 8, 2018 · updated Oct 14, 2026 · xmlsoft libxml2
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Timeline
Detection, updates, and resolution for this record.
Apr 8, 2018 · NIST NVD
Detected
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Oct 14, 2026 · NIST NVD
Updated
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Oct 14, 2026 · OSV.dev
Fix available
libxml2 fixed in 2.9.10+dfsg-2; libxml2 fixed in 2.9.10+dfsg-2; libxml2 fixed in 2.9.10+dfsg-2
Oct 14, 2026 · OSV.dev
Fix available
libxml2 fixed in 2.9.10+dfsg-2
Oct 14, 2026 · OSV.dev
Updated
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Oct 14, 2026 · OSV.dev
Updated
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Oct 14, 2026 · OSV.dev
Updated
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Affected
- Debian:12 libxml20 → 2.9.10+dfsg-2
- Debian:13 libxml20 → 2.9.10+dfsg-2
- Debian:14 libxml20 → 2.9.10+dfsg-2
- cpe xmlsoft/libxml2version unspecified
Sources
- CVE.orgCVE-2017-18258
Official CVE identifier
cve.org - FIRST EPSSCVE-2017-18258
30-day exploitation probability 2.7%
first.org - NIST NVDCVE-2017-18258
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
nvd.nist.gov - OSV.devDEBIAN-CVE-2017-18258osv.dev