EXPOSURES › CVE-2017-7375
CVE-2017-7375
CRITICAL
DETAIL
SourceNVD · cve
Published2018-02-19
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2017-7375 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
DESCRIPTION
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
SENTIMENT · TRUSTED SOURCES
synthesis
severe-fallout
-0.60
CVE-2017-7375 exposed a critical remote code execution flaw in libxml2, allowing attackers to read local files and execute arbitrary code via default parser flags, representing a severe security failu
NVD describes CVE-2017-7375 as a severe flaw allowing remote XML entity inclusion and local file exposure, indicating a critical vulnerability in libxml2 that significantly expands the attack surface.
"A flaw in libxml2 allows remote XML entity inclusion with default parser flags... expose content from local files, HTTP, or FTP servers"
No usable coverage; the source returned a connection error and contains no relevant information about the vulnerability or vendor response.
AFFECTED FEDRAMP PRODUCTS · 2
| PRODUCT | STATUS |
|---|---|
| Google Services (Google Cloud Platform Products and underlying Infrastructure) Google |
Authorized |
| Google Workspace Google |
Authorized |