Vulnerability Description
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
CVSS Score
9.8
CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xmlsoft | Libxml2 | < 2.9.5 |
| Android | 4.4.4 | |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/98877Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038623Third Party AdvisoryVDB Entry
- https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fbPatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1462216Issue TrackingThird Party Advisory
- https://git.gnome.org/browse/libxml2/commit/?id=5dca9eea1bd4263bfa4d037ab2443de1PatchThird Party Advisory
- https://source.android.com/security/bulletin/2017-06-01Third Party Advisory
- https://www.debian.org/security/2017/dsa-3952Third Party Advisory
- http://www.securityfocus.com/bid/98877Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038623Third Party AdvisoryVDB Entry
- https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fbPatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1462216Issue TrackingThird Party Advisory
- https://git.gnome.org/browse/libxml2/commit/?id=5dca9eea1bd4263bfa4d037ab2443de1PatchThird Party Advisory
- https://source.android.com/security/bulletin/2017-06-01Third Party Advisory
- https://www.debian.org/security/2017/dsa-3952Third Party Advisory
FAQ
What is CVE-2017-7376?
CVE-2017-7376 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
How severe is CVE-2017-7376?
CVE-2017-7376 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-7376?
Check the references section above for vendor advisories and patch information. Affected products include: Xmlsoft Libxml2, Google Android, Debian Debian Linux.