Out-of-bounds read in nokogiri (GHSA-8c56-cpmw-89x7)
Published: 2017-12-13T21:38:24Z
Aliases: CVE-2017-9050
Severity: HIGH · CWE: CWE-125

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.  GitHub is notifying on nokogiri as uses libxml2.

Affected packages:
package: ecosystem: RubyGems
name: nokogiri
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.8.1