CVE-2017-7376 -- libxml2

Mon Mar 19 22:05:14 UTC 2018

On 19 Mar, Roger Marquis wrote:
> Assuming FreeBSD's port is also vulnerable even though the OS is not
> listed in the CVE.  Can anyone confirm?
> 
> <https://nvd.nist.gov/vuln/detail/CVE-2017-7376>:
> 
>   Buffer overflow in libxml2 allows remote attackers to execute arbitrary
>   code by leveraging an incorrect limit for port values when handling
>   redirects.

It looks like this has been fixed in version libxml2 version 2.9.7,
which is the current version of the FreeBSD port.

This link on the page referenced above:
  https://git.gnome.org/browse/libxml2/commit/?id=5dca9eea1bd4263bfa4d037ab2443de1cd730f7e
appears to be the bug fix and it is present in the 2.9.7 source.