CVE-2017-7376

Summary

CVE	CVE-2017-7376
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2018-02-19 19:29:00 UTC
Updated	2026-10-14 07:16:40 UTC
Description	Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.

Primary CVSS: v3.0 9.8 CRITICAL from [email protected]

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-119 | n/a

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	9.8	CRITICAL	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
2.0	[email protected]	Primary	10		`AV:N/AC:L/Au:N/C:C/I:C/A:C`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	8.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Google	Android	4.4.4	All	All	All
Operating System	Google	Android	5.0.2	All	All	All
Operating System	Google	Android	5.1.1	All	All	All
Operating System	Google	Android	6.0	All	All	All
Operating System	Google	Android	6.0.1	All	All	All
Operating System	Google	Android	7.0	All	All	All
Operating System	Google	Android	7.1.1	All	All	All
Operating System	Google	Android	7.1.2	All	All	All
Application	Xmlsoft	Libxml2	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified

Reference	Source	Link	Tags
cert-portal.siemens.com/productcert/html/ssa-398330.html	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	cert-portal.siemens.com
Increase buffer space for port in HTTP redirect support (5dca9eea) · Commits · GNOME / libxml2 · GitLab	af854a3a-2127-422b-91ae-364da2661108	git.gnome.org	Patch, Third Party Advisory
51e0cb2e5ec18eaf6fb331bc573ff27b743898f4 - platform/external/libxml2 - Git at Google	af854a3a-2127-422b-91ae-364da2661108	android.googlesource.com	Patch, Third Party Advisory
1462216 – (CVE-2017-7376) CVE-2017-7376 libxml2: Incorrect limit used for port values	af854a3a-2127-422b-91ae-364da2661108	bugzilla.redhat.com	Issue Tracking, Third Party Advisory
Android Security Bulletin—June 2017 \| Android Open Source Project	af854a3a-2127-422b-91ae-364da2661108	source.android.com	Third Party Advisory
Debian -- Security Information -- DSA-3952-1 libxml2	af854a3a-2127-422b-91ae-364da2661108	www.debian.org	Third Party Advisory
Google Android Multiple Flaws Let Remote Users Deny Service, Obtain Potentially Sensitive Information, and Execute Arbitrary Code and Let Local Apps Gain Elevated Privileges - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com	Third Party Advisory, VDB Entry
Google Android Libraries Multiple Remote Code Execution Vulnerabilities	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Third Party Advisory, VDB Entry
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
904877 Common Base Linux Mariner (CBL-Mariner) Security Update for gettext (12334)