Fluid Attacks Database

Description

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
nuget	libxml2	>=0 <=2.9.4	-
alpine v3.4	libxml2	>=0 <2.9.5-r0	2.9.5-r0
debian 13	libxml2	>=0 <2.9.4+dfsg1-3.1	2.9.4+dfsg1-3.1
alpine v3.5	libxml2	>=0 <2.9.5-r0	2.9.5-r0
alpine v3.6	libxml2	>=0 <2.9.5-r0	2.9.5-r0
debian 12	libxml2	>=0 <2.9.4+dfsg1-3.1	2.9.4+dfsg1-3.1
debian 14	libxml2	>=0 <2.9.4+dfsg1-3.1	2.9.4+dfsg1-3.1
rpm rhel5	libxml2	-	-
rpm rhel6	libxml2	-	-
rpm rhel7	libxml2	-	-

Aliases

1. CVE-2017-169312. NVD-2017-169313. OSV-2017-169314. OSV-ALPINE-2017-169315. OSV-DEBIAN-2017-169316. GCVE-2017-169317. SECURITY-CVE-2017-169318. SECURITY-TRACKER-CVE-2017-16931

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.