PT-2017-3747 · Xmlsoft+3 · Libxml2+3

Published 2017-03-03 · Updated 2025-12-03 · CVE-2017-7375

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: libxml2 (affected versions not specified)

Description: A flaw in libxml2 allows remote XML entity inclusion with default parser flags. This may expose a higher-risk attack surface, allowing access to content from local files, HTTP, or FTP servers. The vulnerability is related to insufficient restriction of XML links to external objects, which can be exploited by a remote attacker to execute arbitrary code or cause a denial of service using a specially crafted file.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

ALT-PU-2017-1240

BDU:2019-00235

CVE-2017-7375

DLA-1008-1

DSA-3952-1

MGASA-2018-0048

SUSE-SU-2017:1813-1

USN-3424-1

USN-3424-2

Affected Products

Alt Linux

Suse

Ubuntu

Libxml2

References · 120

• https://source.android.com/security/bulletin/2017-06-01 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7376 · Security Note
• https://bdu.fstec.ru/vul/2016-01382 · Security Note
• https://bdu.fstec.ru/vul/2018-00015 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1838 · Security Note
• https://ubuntu.com/security/notices/USN-3424-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-0663 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4449 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9049 · Security Note
• https://bdu.fstec.ru/vul/2016-01383 · Security Note
• https://bdu.fstec.ru/vul/2016-01379 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9050 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1836 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7375 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00017 · Security Note