CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

Score
9.8 critical
Published
2018-02-19
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
textproc/linux-c7-libxml2linux-c7-libxml22.9.1_4unaddressedemulation@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-c7-libxml2</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A flaw in libxml2 allows remote XML entity inclusion with default
	parser flags (i.e., when the caller did not request entity
	substitution, DTD validation, external DTD subset loading, or default
	DTD attributes). Depending on the context, this may expose a
	higher-risk attack surface in libxml2 not usually reachable with
	default parser flags, and expose content from local files, HTTP, or
	FTP servers (which might be otherwise unreachable).</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2017-7375</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2017-7375</url>
    </references>
    <dates>
      <discovery>2018-02-19</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>