Описание
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 2.9.4+dfsg1-3.1 |
| esm-infra-legacy/trusty | released | 2.9.1+dfsg1-3ubuntu4.10 |
| esm-infra/xenial | released | 2.9.3+dfsg1-1ubuntu0.3 |
| precise/esm | not-affected | 2.7.8.dfsg-5.1ubuntu4.18 |
| trusty | released | 2.9.1+dfsg1-3ubuntu4.10 |
| trusty/esm | released | 2.9.1+dfsg1-3ubuntu4.10 |
| upstream | released | 2.9.4+dfsg1-3.1, 2.9.5 |
| vivid/ubuntu-core | DNE | |
| xenial | released | 2.9.3+dfsg1-1ubuntu0.3 |
| yakkety | ignored | end of life |
Показывать по
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
A flaw in libxml2 allows remote XML entity inclusion with default pars ...
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
Уязвимость компонента xmlParsePEReference библиотеки для работы с XML и HTML файлами libxml2, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3