CVE-2017-7376Critical· 9.8▾ AbyssalPoC availableBuffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 4.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
23%
1 GitHub repo (last check)
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
libxml2 < 2.9.5android = 4.4.4android = 5.0.2android = 5.1.1android = 6.0android = 6.0.1android = 7.0android = 7.1.1android = 7.1.2debian_linux = 8.0debian_linux = 9.0Upgrade past the affected range:
libxml2 2.9.5Connected by shared product, vendor, weakness, or advisory.
CVE-2016-4658Critical· 9.8xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute…
CVE-2017-7375Critical· 9.8A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes)
CVE-2023-39615Medium· 6.5Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c
CVE-2017-16931Critical· 9.8parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
CVE-2017-9048High· 7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow
CVE-2017-9047High· 7.5A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801