Staging Environment: Content and features may be unstable or change without notice.
Advisory details: vulnrichment / CVE-2017-7375
Advisory ID vulnrichment/CVE-2017-7375
Aliases
Summary A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3.1 9.8
ssvc Track
Reference id Reference type URL
https://security.gentoo.org/glsa/201711-01
1038623 Advisory http://www.securitytracker.com/id/1038623
2017-06-01 Other https://source.android.com/security/bulletin/2017-06-01
308396a55280f69ad4112d4f9892f4cbeff042aa Commit https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa
98877 Advisory http://www.securityfocus.com/bid/98877
dsa-3952 Advisory https://www.debian.org/security/2017/dsa-3952
?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e Other https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e
show_bug.cgi?id=1462203 Other https://bugzilla.redhat.com/show_bug.cgi?id=1462203
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at None
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-12-03T21:49:15Z/ Found at None

Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-12-03T21:49:15Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2017/7xxx/CVE-2017-7375.json

Source Advisory: vulnrichment/CVE-2017-7375

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]