Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

Published

2018-02-19T19:29:00.703

Last Modified

2025-12-03T22:15:49.657

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-611
  • Type: Secondary
    CWE-611
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application xmlsoft libxml2 ≤ 2.9.4 Yes
Operating System debian debian_linux 7.0 Yes
Operating System debian debian_linux 8.0 Yes
Operating System debian debian_linux 9.0 Yes
Operating System google android 4.4.4 Yes
Operating System google android 5.0.2 Yes
Operating System google android 5.1.1 Yes
Operating System google android 6.0 Yes
Operating System google android 6.0.1 Yes
Operating System google android 7.0 Yes
Operating System google android 7.1.1 Yes
Operating System google android 7.1.2 Yes
Application xmlsoft libxml2 2.9.4 Yes
Application xmlsoft libxml2 2.9.4 Yes
References