CVE-2017-7375
criticalA flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, exte…
Vendor / product: Xmlsoft — libxml2
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
Timeline (UTC)
Published: 2018-02-19 19:29
Modified: 2026-10-14 07:16
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
xmlsoft / libxml2 ≤2.9.4, 2.9.4
debian / debian_linux 7.0, 8.0, 9.0
google / android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa
Patch / mitigation: https://bugzilla.redhat.com/show_bug.cgi?id=1462203
Patch / mitigation: https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e
Patch / mitigation: https://source.android.com/security/bulletin/2017-06-01
Patch / mitigation: https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa
Patch / mitigation: https://bugzilla.redhat.com/show_bug.cgi?id=1462203
Patch / mitigation: https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e
Patch / mitigation: https://source.android.com/security/bulletin/2017-06-01
References
- http://www.securityfocus.com/bid/98877 cve@mitre.org
- http://www.securitytracker.com/id/1038623 cve@mitre.org
- https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f... cve@mitre.org
- https://bugzilla.redhat.com/show_bug.cgi?id=1462203 cve@mitre.org
- https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e cve@mitre.org
- https://security.gentoo.org/glsa/201711-01 cve@mitre.org
- https://source.android.com/security/bulletin/2017-06-01 cve@mitre.org
- https://www.debian.org/security/2017/dsa-3952 cve@mitre.org
- http://www.securityfocus.com/bid/98877 af854a3a-2127-422b-91ae-364da2661108
- http://www.securitytracker.com/id/1038623 af854a3a-2127-422b-91ae-364da2661108
- https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f... af854a3a-2127-422b-91ae-364da2661108
- https://bugzilla.redhat.com/show_bug.cgi?id=1462203 af854a3a-2127-422b-91ae-364da2661108
- https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e af854a3a-2127-422b-91ae-364da2661108
- https://security.gentoo.org/glsa/201711-01 af854a3a-2127-422b-91ae-364da2661108
- https://source.android.com/security/bulletin/2017-06-01 af854a3a-2127-422b-91ae-364da2661108
- https://www.debian.org/security/2017/dsa-3952 af854a3a-2127-422b-91ae-364da2661108
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗