CVE-2017-10672
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to...
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
- Record
CVE-2017-10672- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
- Record
CVE-2017-10672- Updated
- 2026-11-02
EUVDEUVD-2017-2319 No score
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
- Record
EUVD-2017-2319- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3c8-h936-vqgh
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to...
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
- Record
GHSA-v3c8-h936-vqgh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
- Record
CVE-2017-10672- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-10672
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
- Record
DEBIAN-CVE-2017-10672- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2017-10672
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
- Record
UBUNTU-CVE-2017-10672- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0254 No score
Updated perl-XML-LibXML packages fix security vulnerability
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows attackers to execute arbitrary code by controlling the arguments to a replaceChild call (CVE-2017-10672)
- Record
MGASA-2017-0254- Updated
- 2026-11-02
OSVSUSE-SU-2018:0123-1 No score
Security update for perl-XML-LibXML
This update for perl-XML-LibXML fixes the following issues:
Security issue fixed:
- CVE-2017-10672: Fix use-after-free that allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call (bsc#1046848).
- Record
SUSE-SU-2018:0123-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0170-1 No score
Security update for perl-XML-LibXML
This update for perl-XML-LibXML fixes the following issues:
- CVE-2017-10672: A use-after-free allowed remote attackers to potentially execute arbitrary code by controlling the arguments to a replaceChild call (bsc#1046848)
- Record
SUSE-SU-2018:0170-1- Updated
- 2026-11-02
OSVUSN-3494-1 No score
libxml-libxml-perl vulnerability
It was discovered that XML::LibXML incorrectly handled memory when processing a replaceChild call. A remote attacker could possibly use this issue to execute arbitrary code.
- Record
USN-3494-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxml-libxml-perlDebian:12 |
before 2.0128+dfsg-5 | 2.0128+dfsg-5 |
libxml-libxml-perlDebian:13 |
before 2.0128+dfsg-5 | 2.0128+dfsg-5 |
libxml-libxml-perlDebian:14 |
before 2.0128+dfsg-5 | 2.0128+dfsg-5 |
libxml-libxml-perlDebian:7 |
before 2.0001+dfsg-1+deb7u2, plus listed versions 2.0001+dfsg-12.0001+dfsg-1+deb7u1 |
2.0001+dfsg-1+deb7u2 |
libxml-libxml-perlDebian:8 |
before 2.0116+dfsg-1+deb8u2, plus listed versions 2.0116+dfsg-12.0116+dfsg-1+deb8u1 |
2.0116+dfsg-1+deb8u2 |
libxml-libxml-perlDebian:9 |
before 2.0128+dfsg-1+deb9u1, plus listed versions 2.0128+dfsg-1 |
2.0128+dfsg-1+deb9u1 |
perl-XML-LibXMLMageia:5 |
before 2.12.100-1.1.mga5 | 2.12.100-1.1.mga5 |
perl-XML-LibXMLMageia:6 |
before 2.12.900-1.1.mga6 | 2.12.900-1.1.mga6 |
perl-XML-LibXMLSUSE:Linux Enterprise Desktop 12 SP2 |
before 2.0019-6.3.5 | 2.0019-6.3.5 |
perl-XML-LibXMLSUSE:Linux Enterprise Desktop 12 SP3 |
before 2.0019-6.3.5 | 2.0019-6.3.5 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-XML-LibXMLSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 2.0019-6.3.5 | 2.0019-6.3.5 |
perl-XML-LibXMLSUSE:Linux Enterprise Server 12 SP2 |
before 2.0019-6.3.5 | 2.0019-6.3.5 |
perl-XML-LibXMLSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.0019-6.3.5 | 2.0019-6.3.5 |
perl-XML-LibXMLSUSE:Linux Enterprise Server 12 SP3 |
before 2.0019-6.3.5 | 2.0019-6.3.5 |
perl-XML-LibXMLSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.0019-6.3.5 | 2.0019-6.3.5 |
perl-XML-LibXMLSUSE:Linux Enterprise Point of Sale 11 SP3 |
before 1.66-3.3.1 | 1.66-3.3.1 |
perl-XML-LibXMLSUSE:Linux Enterprise Server 11 SP3-LTSS |
before 1.66-3.3.1 | 1.66-3.3.1 |
perl-XML-LibXMLSUSE:Linux Enterprise Server 11 SP3-TERADATA |
before 1.66-3.3.1 | 1.66-3.3.1 |
perl-XML-LibXMLSUSE:Linux Enterprise Server 11 SP4 |
before 1.66-3.3.1 | 1.66-3.3.1 |
perl-XML-LibXMLSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 1.66-3.3.1 | 1.66-3.3.1 |
libxml-libxml-perlUbuntu:14.04:LTS |
before 2.0108+dfsg-1ubuntu0.2, plus listed versions 2.0010+dfsg-12.0106+dfsg-12.0107+dfsg-12.0108+dfsg-12.0108+dfsg-1ubuntu0.1 |
2.0108+dfsg-1ubuntu0.2 |
libxml-libxml-perlUbuntu:16.04:LTS |
before 2.0123+dfsg-1ubuntu0.1, plus listed versions 2.0116+dfsg-52.0122+dfsg-12.0123+dfsg-12.0123+dfsg-1build1 |
2.0123+dfsg-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-10672 is a critical vulnerability (CVSS 9.8) in Xml-libxml Project Xml-libxml, published June 29, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.93%, the 94th percentile. Fixed in libxml-libxml-perl 2.0128+dfsg-5.
References
debian.org/security/2017/dsa-4042
lists.debian.org/debian-lts-announce/2017/11/msg00017.html
rt.cpan.org/Public/Bug/Display.html?id=122246
nvd.nist.gov/vuln/detail/CVE-2017-10672
github.com/advisories/GHSA-v3c8-h936-vqgh
security-tracker.debian.org/tracker/CVE-2017-10672
Show 10 moreShow less
advisories.mageia.org/MGASA-2017-0254.html
bugs.mageia.org/show_bug.cgi?id=21332
lists.fedoraproject.org/archives/list/[email protected]/thread/CYPWMSEV5NK2JJCTOSA6SAI4RG6MVJH5
suse.com/support/update/announcement/2018/suse-su-20180123-1
bugzilla.suse.com/1046848
ubuntu.com/security/CVE-2017-10672
cve.org/CVERecord?id=CVE-2017-10672