kritik
CVE-2017-7375
libxml2: Missing validation for external entities in xmlParsePEReference
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.5CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (orta), Ubuntu (orta).
Açıklama
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 7 | libxml2 | 2.8.0+dfsg1-7+wheezy8 |
| debian 8 | libxml2 | 2.9.1+dfsg1-5+deb8u5 |
| debian 9 | libxml2 | 2.9.4+dfsg1-2.2+deb9u1 |
| echo | libxml2, libxml2-2.9.1 | 2.9.4+dfsg1-3.1 ve 1 tane daha |
| Red Hat | libxml2, libxml2-devel, libxml2-python ve 4 tane daha | düzeltme belirtilmemiş |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
18 kaynaktaki 26 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-3.1 |
| debian 7 | libxml2 | 2.8.0+dfsg1-7+wheezy8 |
| debian 8 | libxml2 | 2.9.1+dfsg1-5+deb8u5 |
| debian 9 | libxml2 | 2.9.4+dfsg1-2.2+deb9u1 |
| echo | libxml2 | 2.9.4+dfsg1-3.1 |
| echo | libxml2-2.9.1 | 2.9.1+e1 |
| Red Hat | libxml2 | düzeltme belirtilmemiş |
| Red Hat | libxml2-devel | düzeltme belirtilmemiş |
| Red Hat | libxml2-python | düzeltme belirtilmemiş |
| Red Hat | libxml2-static | düzeltme belirtilmemiş |
| Red Hat | mingw-libxml2 | düzeltme belirtilmemiş |
| Red Hat | mingw32-libxml2 | düzeltme belirtilmemiş |
| Red Hat | mingw64-libxml2 | düzeltme belirtilmemiş |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-3.1 |
| seal Red Hat 7 | libxml2 | 2.9.1-6.el7_9.6+sp999 |
| seal Red Hat 7 | seal-libxml2 | 2.9.1-6.el7_9.6+sp999 |
| ubuntu 14.04 | libxml2 | 2.9.1+dfsg1-3ubuntu4.10 |
| ubuntu 14.04-ESM | libxml2 | 2.9.1+dfsg1-3ubuntu4.10 |
| ubuntu 16.04 | libxml2 | 2.9.3+dfsg1-1ubuntu0.3 |
| ubuntu 16.04-ESM | libxml2 | 2.9.3+dfsg1-1ubuntu0.3 |
| ubuntu 17.04 | libxml2 | 2.9.4+dfsg1-2.2ubuntu0.1 |
Referanslar
- http://www.securityfocus.com/bid/98877
- http://www.securitytracker.com/id/1038623
- https://access.redhat.com/security/cve/CVE-2017-7375
- https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa
- https://bugzilla.redhat.com/show_bug.cgi?id=1462203
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e
- https://nvd.nist.gov/vuln/detail/CVE-2017-7375