CVE-2017-7376
Ubuntu Security Notice USN-3424-2
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
Desbordamiento de búfer en libxml2 permite que atacantes remotos ejecuten código arbitrario aprovechando un límite incorrecto para los valores del puerto cuando se gestionan las redirecciones.
Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the application, information leaks, or potentially, the execution of arbitrary code with the privileges of the user running the application. For the oldstable distribution (jessie), these problems have been fixed in version 2.9.1+dfsg1-5+deb8u5. For the stable distribution (stretch), these problems have been fixed in version 2.9.4+dfsg1-2.2+deb9u1. For the unstable distribution (sid), these problems have been fixed in version 2.9.4+dfsg1-3.1.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-03-31 CVE Reserved
- 2017-08-23 CVE Published
- 2023-05-04 First Exploit
- 2024-08-05 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/98877 | Third Party Advisory | |
| http://www.securitytracker.com/id/1038623 | Third Party Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1462216 | Issue Tracking | |
| https://source.android.com/security/bulletin/2017-06-01 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://github.com/brahmstaedt/libxml2-exploit | 2023-05-04 |
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2017/dsa-3952 | 2019-05-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Xmlsoft Search vendor "Xmlsoft" | Libxml2 Search vendor "Xmlsoft" for product "Libxml2" | < 2.9.5 Search vendor "Xmlsoft" for product "Libxml2" and version " < 2.9.5" | - |
Affected
| ||||||
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 4.4.4 Search vendor "Google" for product "Android" and version "4.4.4" | - |
Affected
| ||||||
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 5.0.2 Search vendor "Google" for product "Android" and version "5.0.2" | - |
Affected
| ||||||
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 5.1.1 Search vendor "Google" for product "Android" and version "5.1.1" | - |
Affected
| ||||||
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 6.0 Search vendor "Google" for product "Android" and version "6.0" | - |
Affected
| ||||||
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 6.0.1 Search vendor "Google" for product "Android" and version "6.0.1" | - |
Affected
| ||||||
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 7.0 Search vendor "Google" for product "Android" and version "7.0" | - |
Affected
| ||||||
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 7.1.1 Search vendor "Google" for product "Android" and version "7.1.1" | - |
Affected
| ||||||
| Google Search vendor "Google" | Android Search vendor "Google" for product "Android" | 7.1.2 Search vendor "Google" for product "Android" and version "7.1.2" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||