vulnwire
7.8high

CVE-2017-0663

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within t…

Published 9 y ago · modified 24 d ago · JSON

CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.3%
percentile 84%
Public exploits
0
none known

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.

Exploit prediction (EPSS)

2.32% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.8CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Google Inc. Android
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

References

  • source.android.com /security/bulletin/2017-06-01 · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2017/dsa-3952 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/98877 · vdb-entry, x_refsource_BID, x_transferred
  • security.gentoo.org /glsa/201711-01 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securitytracker.com /id/1038623 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.apache.org /thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkee · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkee · mailing-list, x_refsource_MLIST, x_transferred
  • cert-portal.siemens.com /productcert/html/ssa-398330.html

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.