← Retour aux CVEs

CVE-2017-7375

CRITICAL

9.8

Description

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie2/19/2018

Derniere modification12/3/2025

Sourcenvd

Observations honeypot0

Produits affectes

debian:debian_linuxgoogle:androidxmlsoft:libxml2

Faiblesses (CWE)

CWE-611CWE-611

References

http://www.securityfocus.com/bid/98877(cve@mitre.org)

http://www.securitytracker.com/id/1038623(cve@mitre.org)

https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa(cve@mitre.org)

https://bugzilla.redhat.com/show_bug.cgi?id=1462203(cve@mitre.org)

https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e(cve@mitre.org)

https://security.gentoo.org/glsa/201711-01(cve@mitre.org)

https://source.android.com/security/bulletin/2017-06-01(cve@mitre.org)

https://www.debian.org/security/2017/dsa-3952(cve@mitre.org)

http://www.securityfocus.com/bid/98877(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1038623(af854a3a-2127-422b-91ae-364da2661108)

https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=1462203(af854a3a-2127-422b-91ae-364da2661108)

https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/201711-01(af854a3a-2127-422b-91ae-364da2661108)

https://source.android.com/security/bulletin/2017-06-01(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2017/dsa-3952(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.