{"id":"CVE-2017-8872","aliases":["CLSA-2021-1640700669","CLSA-2021-1640700710","CLSA-2022-1641903536","CLSA-2024-1708417192","DEBIAN-CVE-2017-8872","DLA-2369-1","EUVD-2017-17814","GHSA-8hvw-m45w-cr5x","SUSE-SU-2017:2115-1","SUSE-SU-2017:2141-1","UBUNTU-CVE-2017-8872","USN-4991-1"],"status":"published","title":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a...","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.","severity":{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02306,"percentile":0.8346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2017-05-10T05:14:00Z","modified":"2026-10-24T10:30:38Z","fixes":[{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxml2","fixed_in":["2.7.6-0.77.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2","fixed_in":["2.7.6-0.77.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2-python","fixed_in":["2.7.6-0.77.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2","fixed_in":["2.7.6-0.77.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2-python","fixed_in":["2.7.6-0.77.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"python-libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"python-libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"python-libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"python-libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-libxml2","fixed_in":["2.9.4-46.3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxml2","fixed_in":["2.9.1+dfsg1-3ubuntu4.13+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.0.1.el6_8.1.tuxcare.ol.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.0.1.el6_8.1.tuxcare.ol.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.0.1.el6_8.1.tuxcare.ol.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.0.1.el6_8.1.tuxcare.ol.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.el6_8.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.el6_8.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.el6_8.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.el6_8.1.tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.el7_9.6.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.el7_9.6.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.el7_9.6.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.el7_9.6.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-2.2+deb9u3"}]}],"versions":["2.9.4+dfsg1-2.2","2.9.4+dfsg1-2.2+deb9u1","2.9.4+dfsg1-2.2+deb9u2"],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.3.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13+esm2"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12","2.9.1+dfsg1-3ubuntu4.13","2.9.1+dfsg1-3ubuntu4.13+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+esm1"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5","2.9.3+dfsg1-1ubuntu0.6","2.9.3+dfsg1-1ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13+esm2"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12","2.9.1+dfsg1-3ubuntu4.13","2.9.1+dfsg1-3ubuntu4.13+esm1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+esm1"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5","2.9.3+dfsg1-1ubuntu0.6","2.9.3+dfsg1-1ubuntu0.7"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.4"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1","2.9.4+dfsg1-6.1ubuntu1.2","2.9.4+dfsg1-6.1ubuntu1.3"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.1"}]}],"versions":["2.9.4+dfsg1-7ubuntu3","2.9.4+dfsg1-7ubuntu5","2.9.4+dfsg1-8ubuntu1","2.9.4+dfsg1-8ubuntu2","2.9.4+dfsg1-8ubuntu3","2.9.10+dfsg-1ubuntu3","2.9.10+dfsg-4build1","2.9.10+dfsg-5"],"bundled":8}],"products":[{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=775200","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8872"},{"url":"https://github.com/advisories/GHSA-8hvw-m45w-cr5x"},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1640700669.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1640700710","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1641903536.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1708417192.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-8872","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172115-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1038444","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8872","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172141-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-8872","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4991-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-20388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-24977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3517","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3541","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-8872","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.","status":"published","published":"2017-05-10T05:14:00Z","modified":"2025-12-17T21:59:08.413Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:33:14.89365Z"}],"euvd":[{"id":"EUVD-2017-17814","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.","status":"published","published":"2017-05-10T05:14:00Z","modified":"2025-12-17T21:59:08Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:03.481924Z"}],"ghsa":[{"id":"GHSA-8hvw-m45w-cr5x","title":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a...","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.","status":"published","published":"2022-05-13T01:16:21Z","modified":"2023-02-01T05:04:52Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:50:11.446996Z"}],"nvd":[{"id":"CVE-2017-8872","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.","status":"published","published":"2017-05-10T05:29:00.283Z","modified":"2026-06-17T01:27:07.127Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"},{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"CVE-2017-8872","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.","status":"published","published":"2017-05-10T05:29:00.283Z","modified":"2026-10-24T10:30:38.663109614Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-8872","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.","status":"published","published":"2017-05-10T05:29:00.283Z","modified":"2026-09-01T20:03:51.153524674Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-8872","description":"The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.","status":"published","published":"2017-05-10T05:29:00Z","modified":"2026-04-22T11:35:30.003217Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"CLSA-2021-1640700669","title":"Fixed 8 CVEs in libxml2","description":"- CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities\n- CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd'\n- CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv\n- CVE-2021-3541.patch: parser fix for the billion laughs attack\n- CVE-2021-3516.patch: fix use-after-free with 'xmllint --html --push'\n- CVE-2017-8872.patch: free input buffer in xmlHaltParser\n- CVE-2019-20388.patch: fix memory leak in xmlSchemaValidateStream\n- CVE-2020-24977.patch: fix out-of-bounds read with 'xmllint --htmlout'","status":"published","published":"2021-12-28T14:11:09Z","modified":"2026-10-21T10:48:10.850138028Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1640700710","title":"Fix CVE(s): CVE-2021-3517, CVE-2021-3516, CVE-2020-24977, CVE-2021-3541, CVE-2021-3537, CVE-2021-3518, CVE-2019-20388, CVE-2017-8872","description":"\n   * SECURITY UPDATE: Out-of-bounds array access\n     - debian/patches/CVE-2021-3517.patch: Validate UTF8 in xmlEncodeEntities\n     - CVE-2021-3517\n   * SECURITY UPDATE: Use-after-free error\n     - debian/patches/CVE-2021-3518.patch: Fix use-after-free\n       with 'xmllint --xinclude --dropdtd'\n     - CVE-2021-3518\n   * SECURITY UPDATE: Null pointer dereference while parsing in recovery mode\n     - debian/patches/CVE-2021-3537.patch: Propagate error in\n       xmlParseElementChildrenContentDeclPriv\n     - CVE-2021-3537\n   * SECURITY UPDATE: Parser fix for the billion laugs attach\n     - debian/patches/CVE-2021-3541.patch: Fix parameter entities expansion\n       in xmlParserEntityCheck\n     - CVE-2021-3541\n   * SECURITY UPDATE: Miscalculation of available bytes when parsing\n     - debian/patches/CVE-2017-8872.patch: Free input buffer in xmlHaltParser\n     - CVE-2017-8872\n   * SECURITY UPDATE: Memory leak\n     - debian/patches/CVE-2019-20388.patch: Fix memory leak in\n       xmlSchemaValidateStream\n     - CVE-2019-20388\n   * SECURITY UPDATE: Out-of-bounds array access\n     - debian/patches/CVE-2020-24977.patch: Fix out-of-bounds read with\n       'xmllint --htmlout'\n     - CVE-2020-24977\n   * SECURITY UPDATE: Use-after-free error\n     - debian/patches/CVE-2021-3516.patch: Fix use-after-free\n       with 'xmllint --html --push'\n     - CVE-2021-3516","status":"published","published":"2021-12-28T14:11:50Z","modified":"2026-06-04T10:03:40.10421884Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1641903536","title":"Fix of 8 CVEs","description":"- CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities\n- CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd'\n- CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv\n- CVE-2021-3541.patch: parser fix for the billion laughs attack\n- CVE-2021-3516.patch: fix use-after-free with 'xmllint --html --push'\n- CVE-2017-8872.patch: free input buffer in xmlHaltParser\n- CVE-2019-20388.patch: fix memory leak in xmlSchemaValidateStream\n- CVE-2020-24977.patch: fix out-of-bounds read with 'xmllint --htmlout'","status":"published","published":"2022-01-11T12:18:56Z","modified":"2026-10-21T10:47:15.789020695Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2024-1708417192","title":"libxml2: Fix of 3 CVEs","description":"- CVE-2017-7375: add validation for parsed entity references\n- CVE-2017-7376: fix buffer overflow in URL handling\n- CVE-2017-8872: free input buffer in xmlHaltParser","status":"published","published":"2024-02-20T08:19:55Z","modified":"2026-06-01T00:33:04.058403779Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"DLA-2369-1","title":"libxml2 - security update","status":"published","published":"2020-09-09T00:00:00Z","modified":"2026-03-09T01:23:38.236188Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"SUSE-SU-2017:2115-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2017-8872: Out-of-bounds read could lead to application crash (bsc#1038444)\n\n","status":"published","published":"2017-08-09T14:32:08Z","modified":"2026-02-04T04:18:22.627987Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2141-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2017-8872: Out-of-bounds read in htmlParseTryOrFinish. (bsc#1038444)\n","status":"published","published":"2017-08-11T14:59:34Z","modified":"2026-02-04T02:15:18.355891Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-4991-1","title":"libxml2 vulnerabilities","description":"Yunho Kim discovered that libxml2 incorrectly handled certain error\nconditions. A remote attacker could exploit this with a crafted XML file to\ncause a denial of service, or possibly cause libxml2 to expose sensitive\ninformation. This issue only affected Ubuntu 14.04 ESM, and Ubuntu 16.04\nESM. (CVE-2017-8872)\n\nZhipeng Xie discovered that libxml2 incorrectly handled certain XML\nschemas. A remote attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM,\nand Ubuntu 18.04 LTS. (CVE-2019-20388)\n\nIt was discovered that libxml2 incorrectly handled invalid UTF-8 input. A\nremote attacker could possibly exploit this with a crafted XML file to\ncause libxml2 to crash, resulting in a denial of service. This issue only\naffected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS and Ubuntu 20.10. (CVE-2020-24977)\n\nIt was discovered that libxml2 incorrectly handled invalid UTF-8 input. A\nremote attacker could possibly exploit this with a crafted XML file to\ncause libxml2 to crash, resulting in a denial of service. (CVE-2021-3517)\n\nIt was discovered that libxml2 did not properly handle certain crafted XML\nfiles. A local attacker could exploit this with a crafted input to cause\nlibxml2 to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2021-3516, CVE-2021-3518)\n\nIt was discovered that libxml2 incorrectly handled error states. A remote\nattacker could exploit this with a crafted XML file to cause libxml2 to\ncrash, resulting in a denial of service. (CVE-2021-3537)\n\nSebastian Pipping discovered that libxml2 did not properly handle certain\ncrafted XML files. A remote attacker could exploit this with a crafted XML\nfile to cause libxml2 to crash, resulting in a denial of service. This\nissue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04.\n(CVE-2021-3541)\n","status":"published","published":"2021-06-17T14:59:21Z","modified":"2026-06-29T13:49:26.848160826Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}