CVE-2017-7375 A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD a...
CriticalCVSS 9.8
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxml2(Debian:12) | < 2.9.4+dfsg1-3.1 | 2.9.4+dfsg1-3.1 |
| debian/libxml2(Debian:13) | < 2.9.4+dfsg1-3.1 | 2.9.4+dfsg1-3.1 |
| debian/libxml2(Debian:14) | < 2.9.4+dfsg1-3.1 | 2.9.4+dfsg1-3.1 |
| Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| xmlsoft libxml2 | <= 2.9.4 | No fix listed |
| xmlsoft libxml2 | = 2.9.4-rc1 | No fix listed |
| xmlsoft libxml2 | = 2.9.4-rc2 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Google Android | = 4.4.4 | No fix listed |
| Google Android | = 5.0.2 | No fix listed |
| Google Android | = 5.1.1 | No fix listed |
| Google Android | = 6.0 | No fix listed |
| Google Android | = 6.0.1 | No fix listed |
| Google Android | = 7.0 | No fix listed |
| Google Android | = 7.1.1 | No fix listed |
| Google Android | = 7.1.2 | No fix listed |
References
- Debian Security Tracker CVE-2017-7375 vendor-advisory
- android.googlesource.com patch third-party-advisory
- source.android.com patch third-party-advisory
- DSA-3952 third-party-advisory vendor-advisory
- 98877 third-party-advisory vdb-entry
- GLSA-201711-01 third-party-advisory vendor-advisory
- git.gnome.org patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- 1038623 third-party-advisory vdb-entry
- cert-portal.siemens.com
- bugs.debian.org issue-tracking