CVE-2017-7375 | BDVDB-2026-96890 Detail
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Description#
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-611 Improper Restriction of XML External Entity Reference
References#
- https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa
- https://source.android.com/security/bulletin/2017-06-01
- https://www.debian.org/security/2017/dsa-3952
- http://www.securityfocus.com/bid/98877
- https://security.gentoo.org/glsa/201711-01
- https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e
- https://bugzilla.redhat.com/show_bug.cgi?id=1462203
- http://www.securitytracker.com/id/1038623
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.