CVE-2017-7375

Published: 21 June 2017

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
libxml2
Launchpad, Ubuntu, Debian
Upstream
Released (2.9.4+dfsg1-3.1)
Ubuntu 16.04 LTS (Xenial Xerus)
Released (2.9.3+dfsg1-1ubuntu0.3)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (2.9.1+dfsg1-3ubuntu4.10)
Patches:
Distro: https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa
Upstream: https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e