Your submission was sent successfully! Close

CVE-2017-7375

Published: 21 June 2017

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
libxml2
Launchpad, Ubuntu, Debian
precise
Released (2.7.8.dfsg-5.1ubuntu4.18)
trusty
Released (2.9.1+dfsg1-3ubuntu4.10)
upstream
Released (2.9.4+dfsg1-3.1)
xenial
Released (2.9.3+dfsg1-1ubuntu0.3)
yakkety Ignored
(reached end-of-life)
zesty
Released (2.9.4+dfsg1-2.2ubuntu0.1)