CVE-2017-7375CWE-611xxe

CVE-2017-7375

Critical · published February 20, 2018

CVSS v3.1
9.8
EPSS
3%
Percentile
87.1
In the wild
Unconfirmed
What it is

🚨 A flaw in libxml2 allows attackers to play a sneaky game of hide-and-seek with your data! 🔥 Think of libxml2 as a restaurant that serves up delicious XML dishes. The flaw is like a waiter who, without checking the menu, decides to grab secret ingredients from the kitchen, even those meant to stay hidden! This vulnerability could lead to a complete data exposure disaster, allowing attackers to access sensitive files and other resources that should be off-limits. Imagine someone rifling through your personal belongings when you thought you were safe! It's a critical situation that could expose your system to severe risks.

Put simply

Think of libxml2 as a restaurant that serves up delicious XML dishes. The flaw is like a waiter who, without checking the menu, decides to grab secret ingredients from the kitchen, even those meant to stay hidden! CVE-2017-7375 is a remote XML entity inclusion vulnerability in libxml2, triggered when the parser uses default flags, allowing it to fetch unintended external data from local files, HTTP, or FTP servers even when not explicitly requested.

What to do

This vulnerability could lead to a complete data exposure disaster, allowing attackers to access sensitive files and other resources that should be off-limits. Imagine someone rifling through your personal belongings when you thought you were safe! It's a critical situation that could expose your system to severe risks. To mitigate this issue, ensure you upgrade libxml2 to version 2.9.4 or later. Additionally, double-check your parser settings to disable unnecessary features like DTD processing unless absolutely needed! You've got this! With these steps, you'll keep your data safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02980 · 87.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2018-02-20T00:29Z
Affected products (14)
ProductVersionsFixed in
xmlsoft/libxml2≤ 2.9.4—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
xmlsoft/libxml2all versions—
xmlsoft/libxml2all versions—
References (17)
http://www.securityfocus.com/bid/98877 · [email protected]http://www.securitytracker.com/id/1038623 · [email protected]https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=1462203 · [email protected]https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e · [email protected]https://security.gentoo.org/glsa/201711-01 · [email protected]https://source.android.com/security/bulletin/2017-06-01 · [email protected]https://www.debian.org/security/2017/dsa-3952 · [email protected]http://www.securityfocus.com/bid/98877 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1038623 · af854a3a-2127-422b-91ae-364da2661108https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1462203 · af854a3a-2127-422b-91ae-364da2661108https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201711-01 · af854a3a-2127-422b-91ae-364da2661108https://source.android.com/security/bulletin/2017-06-01 · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2017/dsa-3952 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 19 FEB 19:00Z
    A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation…
    cvelistv5