CVE-2017-16932
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 6.5% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-25)
- CWE
- CWE-835
- Published
- Modified
- Record from
- the NVD, synced
Affected
- xmlsoft:libxml2
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x2fm-93ww-ggvx | RubyGems | nokogiri | <1.8.1 | 1.8.1 |
References
- http://xmlsoft.org/news.html
- https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html
- https://bugzilla.gnome.org/show_bug.cgi?id=759579
- https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961