CVE-2017-0663
CVE-2017-0663
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.
CVSS 7.8 · High · EPSS 2.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
android
- Versions
- Android-4.4.4 Android-5.0.2 Android-5.1.1 Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2: Affected
No fix published
libxml2 Debian:12
- Affected ranges
- ECOSYSTEM: < 2.9.4+dfsg1-3.1
Update to 2.9.4+dfsg1-3.1
libxml2 Debian:13
- Affected ranges
- ECOSYSTEM: < 2.9.4+dfsg1-3.1
Update to 2.9.4+dfsg1-3.1
libxml2 Debian:14
- Affected ranges
- ECOSYSTEM: < 2.9.4+dfsg1-3.1
Update to 2.9.4+dfsg1-3.1
libxml2 Ubuntu:14.04:LTS
- Versions
- 2.9.1+dfsg1-3ubuntu2
- 2.9.1+dfsg1-3ubuntu3
- 2.9.1+dfsg1-3ubuntu4
- 2.9.1+dfsg1-3ubuntu4.1
- 2.9.1+dfsg1-3ubuntu4.2
- 2.9.1+dfsg1-3ubuntu4.3
- 2.9.1+dfsg1-3ubuntu4.4
- 2.9.1+dfsg1-3ubuntu4.5
- 2.9.1+dfsg1-3ubuntu4.6
- 2.9.1+dfsg1-3ubuntu4.7
- 2.9.1+dfsg1-3ubuntu4.8
- 2.9.1+dfsg1-3ubuntu4.9
- Affected ranges
- ECOSYSTEM: < 2.9.1+dfsg1-3ubuntu4.10
Update to 2.9.1+dfsg1-3ubuntu4.10
libxml2 Ubuntu:16.04:LTS
- Versions
- 2.9.2+zdfsg1-4
- 2.9.2+zdfsg1-4ubuntu1
- 2.9.2+zdfsg1-4ubuntu2
- 2.9.2+zdfsg1-4ubuntu3
- 2.9.3+dfsg1-1
- 2.9.3+dfsg1-1ubuntu0.1
- 2.9.3+dfsg1-1ubuntu0.2
- Affected ranges
- ECOSYSTEM: < 2.9.3+dfsg1-1ubuntu0.3
Update to 2.9.3+dfsg1-1ubuntu0.3
android Ubuntu:16.04:LTS
- Versions
- 20150818-1500-0ubuntu2
- 20150818-1500-0ubuntu3
- 20160307-0742-0ubuntu3
- 20160330-0939-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://source.android.com/security/bulletin/2017-06-01
- http://www.debian.org/security/2017/dsa-3952
- http://www.securityfocus.com/bid/98877
- https://security.gentoo.org/glsa/201711-01
- http://www.securitytracker.com/id/1038623
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-0663