A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
Fix
Patch, vendor advisory and mitigation references on NVD 8
- https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1462203 Issue Tracking, Patch, Third Party Advisory
- https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e Patch, Third Party Advisory
- https://source.android.com/security/bulletin/2017-06-01 Patch, Third Party Advisory
- https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1462203 Issue Tracking, Patch, Third Party Advisory
- https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e Patch, Third Party Advisory
- https://source.android.com/security/bulletin/2017-06-01 Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · xmlsoft, debian, googleNVD modified 2026-10-14 07:16
Affected (CPE criteria) 14
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*cpe:2.3:a:xmlsoft:libxml2:2.9.4:rc1:*:*:*:*:*:*cpe:2.3:a:xmlsoft:libxml2:2.9.4:rc2:*:*:*:*:*:*
References 17
- http://www.securityfocus.com/bid/98877 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038623 Third Party Advisory, VDB Entry
- https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1462203 Issue Tracking, Patch, Third Party Advisory
- https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201711-01 Third Party Advisory
- https://source.android.com/security/bulletin/2017-06-01 Patch, Third Party Advisory
- https://www.debian.org/security/2017/dsa-3952 Third Party Advisory
- http://www.securityfocus.com/bid/98877 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038623 Third Party Advisory, VDB Entry
- https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1462203 Issue Tracking, Patch, Third Party Advisory
- https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201711-01 Third Party Advisory
- https://source.android.com/security/bulletin/2017-06-01 Patch, Third Party Advisory
- https://www.debian.org/security/2017/dsa-3952 Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html