Search for vulnerabilities
Vulnerability details: VCID-upj8-wt85-tufp
Vulnerability ID VCID-upj8-wt85-tufp
Aliases CVE-2017-15412
GHSA-r58r-74gx-6wx3
Summary Nokogiri gem, via libxml, is affected by DoS vulnerabilities The version of libxml2 packaged with Nokogiri contains a vulnerability. Nokogiri has mitigated these issue by upgrading to libxml 2.9.6. It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-416 Use After Free
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 8.8 https://access.redhat.com/errata/RHSA-2017:3401
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:3401
cvssv3.1 8.8 https://access.redhat.com/errata/RHSA-2018:0287
generic_textual HIGH https://access.redhat.com/errata/RHSA-2018:0287
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15412.json
epss 0.03249 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
epss 0.03481 https://api.first.org/data/v1/epss?cve=CVE-2017-15412
cvssv3.1 8.8 https://bugzilla.gnome.org/show_bug.cgi?id=783160
generic_textual HIGH https://bugzilla.gnome.org/show_bug.cgi?id=783160
cvssv3.1 8.8 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
generic_textual HIGH https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
cvssv3.1 8.8 https://crbug.com/727039
generic_textual HIGH https://crbug.com/727039
cvssv3 8.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-r58r-74gx-6wx3
cvssv3.1 8.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml
cvssv3 8.8 https://github.com/sparklemotion/nokogiri/issues/1714
cvssv3.1 8.8 https://github.com/sparklemotion/nokogiri/issues/1714
generic_textual HIGH https://github.com/sparklemotion/nokogiri/issues/1714
cvssv3.1 8.8 https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html
cvssv2 6.8 https://nvd.nist.gov/vuln/detail/CVE-2017-15412
cvssv3 8.8 https://nvd.nist.gov/vuln/detail/CVE-2017-15412
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2017-15412
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2017-15412
archlinux Critical https://security.archlinux.org/AVG-544
cvssv3.1 8.8 https://security.gentoo.org/glsa/201801-03
generic_textual HIGH https://security.gentoo.org/glsa/201801-03
cvssv3.1 8.8 https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348
generic_textual HIGH https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348
cvssv3.1 8.8 https://www.debian.org/security/2018/dsa-4086
generic_textual HIGH https://www.debian.org/security/2018/dsa-4086
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2017:3401
https://access.redhat.com/errata/RHSA-2018:0287
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15412.json
https://api.first.org/data/v1/epss?cve=CVE-2017-15412
https://bugzilla.gnome.org/show_bug.cgi?id=783160
https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
https://crbug.com/727039
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml
https://github.com/sparklemotion/nokogiri/issues/1714
https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html
https://nvd.nist.gov/vuln/detail/CVE-2017-15412
https://security.gentoo.org/glsa/201801-03
https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348
https://www.debian.org/security/2018/dsa-4086
http://www.securitytracker.com/id/1040348
1523128 https://bugzilla.redhat.com/show_bug.cgi?id=1523128
883790 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883790
ASA-201712-5 https://security.archlinux.org/ASA-201712-5
AVG-544 https://security.archlinux.org/AVG-544
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
CVE-2017-15412.HTML https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html
GHSA-r58r-74gx-6wx3 https://github.com/advisories/GHSA-r58r-74gx-6wx3
RHSA-2020:1190 https://access.redhat.com/errata/RHSA-2020:1190
USN-3513-1 https://usn.ubuntu.com/3513-1/
USN-3513-2 https://usn.ubuntu.com/3513-2/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:3401
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2018:0287
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15412.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.gnome.org/show_bug.cgi?id=783160
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://crbug.com/727039
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/sparklemotion/nokogiri/issues/1714
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2017-15412
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-15412
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-15412
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/201801-03
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2018/dsa-4086
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.86622
EPSS Score 0.03249
Published At Aug. 17, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:04:56.011665+00:00 Ruby Importer Import https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml 37.0.0