{"id":"CVE-2017-7375","aliases":["CLSA-2024-1708417192","DEBIAN-CVE-2017-7375","DLA-1008-1","DSA-3952-1","EUVD-2017-16402","GHSA-ww2p-x466-vpwf","MGASA-2018-0048","SUSE-SU-2017:1813-1","UBUNTU-CVE-2017-7375","USN-3424-1"],"status":"published","title":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the...","description":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0298,"percentile":0.87364,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2017-06-21T00:00:00Z","modified":"2026-10-24T10:30:33Z","fixes":[{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.4+dfsg1-3.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.9.4+dfsg1-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.9.4+dfsg1-3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","fixed_in":["2.9.1+dfsg1-3ubuntu4.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.el7_9.6.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.el7_9.6.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.el7_9.6.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.el7_9.6.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-3.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-3.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0+dfsg1-7+wheezy8"}]}],"versions":["2.8.0+dfsg1-7+nmu1","2.8.0+dfsg1-7+nmu2","2.8.0+dfsg1-7+nmu3","2.8.0+dfsg1-7+wheezy1","2.8.0+dfsg1-7+wheezy2","2.8.0+dfsg1-7+wheezy3","2.8.0+dfsg1-7+wheezy4","2.8.0+dfsg1-7+wheezy5","2.8.0+dfsg1-7+wheezy6","2.8.0+dfsg1-7+wheezy7"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-5+deb8u5"}]}],"versions":["2.9.1+dfsg1-5","2.9.1+dfsg1-5+deb8u1","2.9.1+dfsg1-5+deb8u2","2.9.1+dfsg1-5+deb8u3","2.9.1+dfsg1-5+deb8u4"],"bundled":7},{"source":"osv","ecosystem":"Debian:9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-2.2+deb9u1"}]}],"versions":["2.9.4+dfsg1-2.2"],"bundled":7},{"source":"osv","ecosystem":"Mageia:5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-1.mga5"}]}],"bundled":14},{"source":"osv","ecosystem":"Mageia:5","package":"perl-XML-LibXML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.100-1.2.mga5"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.76.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.76.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.76.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.76.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.76.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.10"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.3"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.10"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.3"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2"],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"google","product":"android"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://source.android.com/security/bulletin/2017-06-01","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.debian.org/security/2017/dsa-3952","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/98877","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201711-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462203","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.securitytracker.com/id/1038623","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7375"},{"url":"https://github.com/advisories/GHSA-ww2p-x466-vpwf"},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1708417192.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7375","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0048.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19695","tags":["report"]},{"url":"https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-02/msg00055.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-06/msg00022.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-07/msg00000.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-07/msg00040.html","tags":["web"]},{"url":"https://usn.ubuntu.com/usn/usn-3513-1/","tags":["web"]},{"url":"https://usn.ubuntu.com/usn/usn-3504-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171813-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1024989","tags":["report"]},{"url":"https://bugzilla.suse.com/1044337","tags":["report"]},{"url":"https://bugzilla.suse.com/1044887","tags":["report"]},{"url":"https://bugzilla.suse.com/1044894","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7376","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-7375","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3424-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3424-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-0663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9050","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7375","description":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).","status":"published","published":"2018-02-19T19:00:00Z","modified":"2026-10-14T06:30:14.984Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-16402","description":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).","status":"published","published":"2018-02-19T19:00:00Z","modified":"2026-10-14T06:30:14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:17.902641Z"}],"ghsa":[{"id":"GHSA-ww2p-x466-vpwf","title":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the...","description":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).","status":"published","published":"2022-05-14T03:36:50Z","modified":"2026-10-14T09:32:18Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2017-7375","description":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).","status":"published","published":"2018-02-19T19:29:00.703Z","modified":"2026-10-14T07:16:40.303Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:04:15.877386Z"}],"osv":[{"id":"CVE-2017-7375","description":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).","status":"published","published":"2018-02-19T19:29:00.703Z","modified":"2026-10-24T10:30:33.341429264Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7375","description":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).","status":"published","published":"2018-02-19T19:29:00.703Z","modified":"2026-10-15T07:47:38.631868477Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-7375","description":"A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).","status":"published","published":"2017-06-21T00:00:00Z","modified":"2026-04-22T11:30:30.743377Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"CLSA-2024-1708417192","title":"libxml2: Fix of 3 CVEs","description":"- CVE-2017-7375: add validation for parsed entity references\n- CVE-2017-7376: fix buffer overflow in URL handling\n- CVE-2017-8872: free input buffer in xmlHaltParser","status":"published","published":"2024-02-20T08:19:55Z","modified":"2026-06-01T00:33:04.058403779Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"DLA-1008-1","title":"libxml2 - security update","status":"published","published":"2017-06-30T00:00:00Z","modified":"2026-03-09T01:01:08.240926Z","updated_at":"2026-11-02T15:46:08.746073Z"},{"id":"DSA-3952-1","title":"libxml2 - security update","status":"published","published":"2017-08-23T00:00:00Z","modified":"2026-03-09T01:20:07.732982Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0048","title":"Updated libxml2 \u0026 perl-XML-LibXML packages fix security vulnerabilities","description":"Use-after-free error could lead to crash (CVE-2016-4658).\n\nUse-after-free vulnerability in libxml2 through 2.9.4 allows remote\nattackers to cause a denial of service or possibly have unspecified\nother impact via vectors related to the XPointer range-to function\n(CVE-2016-5131).\n\nlibxml2 2.9.4 and earlier does not offer a flag directly indicating that\nthe current document may be read but other files may not be opened,\nwhich makes it easier for remote attackers to conduct XML External\nEntity (XXE) attacks via a crafted document (CVE-2016-9318).\n\nHeap buffer overflow in xmlAddID (CVE-2017-0663).\n\nInteger overflow in memory debug code in libxml2 before 2.9.5\n(CVE-2017-5130).\n\nNULL pointer deref in xmlDumpElementContent (CVE-2017-5969).\n\nPrevent unwanted external entity reference (CVE-2017-7375).\n\nIncrease buffer space for port in HTTP redirect support (CVE-2017-7376).\n\nThe function xmlSnprintfElementContent in valid.c was vulnerable to a\nstack buffer overflow (CVE-2017-9047, CVE-2017-9048).\n\nThe function xmlDictComputeFastKey in dict.c was vulnerable to a\nheap-based buffer over-read (CVE-2017-9049).\n\nThe function xmlDictAddString was vulnerable to a heap-based buffer\nover-read (CVE-2017-9050).\n\nIt was discovered that libxml2 incorrecty handled certain files. An\nattacker could use this issue with specially constructed XML data to\ncause libxml2 to consume resources, leading to a denial of service\n(CVE-2017-15412).\n\nWei Lei discovered that libxml2 incorrecty handled certain parameter\nentities. An attacker could use this issue with specially constructed\nXML data to cause libxml2 to consume resources, leading to a denial of\nservice (CVE-2017-16932).\n\nThe libxml2 package has been updated to version 2.9.7 to fix these\nissues and several other bugs.\n","status":"published","published":"2018-01-03T15:50:51Z","modified":"2026-04-16T06:24:17.80338112Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:1813-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2017-0663: Fixed a heap buffer overflow in xmlAddID (bsc#1044337)\n* CVE-2017-5969: Fixed a NULL pointer deref in xmlDumpElementContent (bsc#1024989)\n* CVE-2017-7375: Prevented an unwanted external entity reference (bsc#1044894)\n* CVE-2017-7376: Increase buffer space for port in HTTP redirect support (bsc#1044887)\n\n","status":"published","published":"2017-07-07T09:25:11Z","modified":"2026-02-04T04:02:00.570308Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-3424-1","title":"libxml2 vulnerabilities","description":"It was discovered that a type confusion error existed in libxml2. An\nattacker could use this to specially construct XML data that\ncould cause a denial of service or possibly execute arbitrary\ncode. (CVE-2017-0663)\n\nIt was discovered that libxml2 did not properly validate parsed entity\nreferences. An attacker could use this to specially construct XML\ndata that could expose sensitive information. (CVE-2017-7375)\n\nIt was discovered that a buffer overflow existed in libxml2 when\nhandling HTTP redirects. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-7376)\n\nMarcel Böhme and Van-Thuan Pham discovered a buffer overflow in\nlibxml2 when handling elements. An attacker could use this to specially\nconstruct XML data that could cause a denial of service or possibly\nexecute arbitrary code. (CVE-2017-9047)\n\nMarcel Böhme and Van-Thuan Pham discovered a buffer overread\nin libxml2 when handling elements. An attacker could use this\nto specially construct XML data that could cause a denial of\nservice. (CVE-2017-9048)\n\nMarcel Böhme and Van-Thuan Pham discovered multiple buffer overreads\nin libxml2 when handling parameter-entity references. An attacker\ncould use these to specially construct XML data that could cause a\ndenial of service. (CVE-2017-9049, CVE-2017-9050)\n","status":"published","published":"2017-09-19T00:47:53Z","modified":"2026-04-22T09:39:05.633631Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}