CVE-2017-7376

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2017-7376
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-7376.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-7376
Downstream
Related
Published
2018-02-19T19:29:00Z
Modified
2025-09-05T06:00:14.471318Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.

References

Affected packages

Debian:11 / libxml2

Package

Name
libxml2
Purl
pkg:deb/debian/libxml2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9.4+dfsg1-3.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / libxml2

Package

Name
libxml2
Purl
pkg:deb/debian/libxml2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9.4+dfsg1-3.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / libxml2

Package

Name
libxml2
Purl
pkg:deb/debian/libxml2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9.4+dfsg1-3.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / libxml2

Package

Name
libxml2
Purl
pkg:deb/debian/libxml2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.9.4+dfsg1-3.1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/gnome/libxml2

Affected ranges

Type
GIT
Repo
https://github.com/gnome/libxml2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2960178fe8f9fe690b7f8c1c49093ff54bb56934

Affected versions

Other

CVE-2013-2877
CVE-2014-0191
CVE-2014-3660
CVE-2015-1819
CVE-2015-5312
CVE-2015-7497
CVE-2015-7498
CVE-2015-7499-1
CVE-2015-7499-2
CVE-2015-7500
CVE-2015-7941_1
CVE-2015-7941_2
CVE-2015-7942
CVE-2015-7942-2
CVE-2015-8035
CVE-2015-8242
CVE-2015-8317
CVE-2016-1762
CVE-2016-1833
CVE-2016-1834
CVE-2016-1835
CVE-2016-1836
CVE-2016-1837
CVE-2016-1838
CVE-2016-1839
CVE-2016-1840
CVE-2016-3627
CVE-2016-3705
CVE-2016-4449
CVE-2016-4483
EAZEL-NAUTILUS-MS-AUG07
FOR_GNOME_0_99_1
GNOME_0_30
GNOME_PRINT_0_24
GNUMERIC_FIRST_PUBLIC_RELEASE
LIBXML2_2_4_21
LIBXML2_2_5_0
LIBXML2_2_5_10
LIBXML2_2_5_7
LIBXML2_2_5_8
LIBXML2_2_5_9
LIBXML2_2_5_x
LIBXML2_2_6_1
LIBXML2_2_6_11
LIBXML2_2_6_12
LIBXML2_2_6_13
LIBXML2_2_6_14
LIBXML2_2_6_15
LIBXML2_2_6_16
LIBXML2_2_6_18
LIBXML2_2_6_19
LIBXML2_2_6_2
LIBXML2_2_6_20
LIBXML2_2_6_21
LIBXML2_2_6_22
LIBXML2_2_6_23
LIBXML2_2_6_24
LIBXML2_2_6_26
LIBXML2_2_6_27
LIBXML2_2_6_28
LIBXML2_2_6_3
LIBXML2_2_6_4
LIBXML2_2_6_5
LIBXML2_2_6_6
LIBXML2_2_6_7
LIBXML2_2_6_8
LIBXML2_2_6_9
LIBXML2_6_0
LIBXML_0_99
LIBXML_1_5_0
LIBXML_1_8_5
LIBXML_1_8_6
LIBXML_2_0_0
LIBXML_2_1_0
LIBXML_2_1_1
LIBXML_2_2_1
LIBXML_2_2_3
LIBXML_2_2_4
LIBXML_2_2_6
LIBXML_2_2_7
LIBXML_2_2_8
LIBXML_2_3_0
LIBXML_2_3_10
LIBXML_2_3_11
LIBXML_2_3_12
LIBXML_2_3_13
LIBXML_2_3_14
LIBXML_2_3_2
LIBXML_2_3_3
LIBXML_2_3_4
LIBXML_2_3_5
LIBXML_2_3_6
LIBXML_2_3_7
LIBXML_2_3_8
LIBXML_2_3_9
LIBXML_2_4_0
LIBXML_2_4_11
LIBXML_2_4_12
LIBXML_2_4_13
LIBXML_2_4_14
LIBXML_2_4_16
LIBXML_2_4_18
LIBXML_2_4_2
LIBXML_2_4_20
LIBXML_2_4_22
LIBXML_2_4_23
LIBXML_2_4_24
LIBXML_2_4_25
LIBXML_2_4_26
LIBXML_2_4_27
LIBXML_2_4_29
LIBXML_2_4_3
LIBXML_2_4_30
LIBXML_2_4_4
LIBXML_2_4_6
LIBXML_2_4_7
LIBXML_2_5_1
LIBXML_2_5_2
LIBXML_2_5_3
LIBXML_2_5_4
LIBXML_2_5_5
LIBXML_2_5_6
LIBXML_2_6_10
LIBXML_TEST_2_0_0
LIB_XML_1_1
LIB_XML_1_3
LIB_XML_1_4
LIB_XML_1_6_1
LIB_XML_1_6_2
LIB_XML_1_7_0
LIB_XML_1_7_1
LIB_XML_1_7_3
LIB_XML_1_8_3
LIB_XML_1_X
PRE_MUCKUP
PRE_MUCKUP2
PRE_MUCKUP3
help

LIBXML2.*

LIBXML2.6.32
LIBXML2.7.0
LIBXML2.7.1
LIBXML2.7.2
LIBXML2.7.3

v2.*

v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.8.0
v2.8.0-rc1
v2.8.0-rc2
v2.9.0
v2.9.0-rc2
v2.9.1
v2.9.2
v2.9.2-rc1
v2.9.2-rc2
v2.9.3
v2.9.4
v2.9.4-rc1
v2.9.4-rc2
v2.9.5-rc1
v2.9.5-rc2

Database specific 

{
    "vanir_signatures": [
        {
            "id": "CVE-2017-7376-19478d5f",
            "digest": {
                "function_hash": "112248867965903609915723946676775857518",
                "length": 1117.0
            },
            "target": {
                "file": "testapi.c",
                "function": "test_htmlSAXParseDoc"
            },
            "signature_type": "Function",
            "signature_version": "v1",
            "deprecated": false,
            "source": "https://github.com/gnome/libxml2/commit/2960178fe8f9fe690b7f8c1c49093ff54bb56934"
        },
        {
            "id": "CVE-2017-7376-89b5dc4d",
            "digest": {
                "function_hash": "38348634201758905247739532917813109503",
                "length": 767.0
            },
            "target": {
                "file": "testapi.c",
                "function": "test_htmlParseDoc"
            },
            "signature_type": "Function",
            "signature_version": "v1",
            "deprecated": false,
            "source": "https://github.com/gnome/libxml2/commit/2960178fe8f9fe690b7f8c1c49093ff54bb56934"
        },
        {
            "id": "CVE-2017-7376-e5f2af1b",
            "digest": {
                "line_hashes": [
                    "18510610942270394731172998854272046180",
                    "272748755794134121945945645792957225480",
                    "54170169248121335931444949896552358687",
                    "141089055786028102755735090319227455438",
                    "61665964622432689858905164713550904594",
                    "332535206619352013955651071087240089104",
                    "11231465942016107446610738495321400656",
                    "215494287859239729874911814193941839532",
                    "36891550013450279247405052038668386033",
                    "24991833791440923208649426832086945460",
                    "139714036997992623004062074565986876498",
                    "24245789418884720468647596232212633648",
                    "267295892910826817260149179528614688144",
                    "179109886395490105780720882533536528140",
                    "151259951245585662196521411478148296104",
                    "38537598450160409476045033766076828823",
                    "47459329859408502495898681105694726249",
                    "160536182796787516147256792125138784805",
                    "211353063145894117724334928961077636095",
                    "49361339725490249555053070855976691417",
                    "308934692980350398322234333889317410200",
                    "328098667523760641400254992147984410806",
                    "67310314071343413901973223584689871330",
                    "21903990548253296273615755153238058760",
                    "172558680497795066381628227374527790262",
                    "24991833791440923208649426832086945460",
                    "191308631179146184287867750257181619641",
                    "118370134756265465106062605585184135118"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "testapi.c"
            },
            "signature_type": "Line",
            "signature_version": "v1",
            "deprecated": false,
            "source": "https://github.com/gnome/libxml2/commit/2960178fe8f9fe690b7f8c1c49093ff54bb56934"
        }
    ]
}