CVE-2017-16931

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

http://xmlsoft.org/news.htmlRelease Notes, Vendor Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=766956Permissions Required
https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html
https://www.oracle.com//security-alerts/cpujul2021.html
http://xmlsoft.org/news.htmlRelease Notes, Vendor Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=766956Permissions Required
https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline

Published: Nov 23, 2017
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-169327.5parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.CVE-2017-169337.0etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, which allows local use CVE-2017-169349.8The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.ht CVE-2017-169359.8Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended acc CVE-2017-169366.5Directory Traversal vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac9_kf_V15.03.05.19(631 CVE-2017-169387.8A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a mal CVE-2017-169397.8The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or caus CVE-2017-16948.1IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle CVE-2017-169418.8October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP co CVE-2017-169426.5In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c, which may lead CVE-2017-169439.8The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a CVE-2017-169447.5The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinit