ZeroDay Findings
Sign inSign up

Findings

CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DT

Published Nov 23, 2017 · updated Oct 14, 2026 · xmlsoft libxml2

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 23, 2017 · NIST NVD

    Detected

    parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

  2. Oct 14, 2026 · NIST NVD

    Updated

    parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

  3. Oct 14, 2026 · OSV.dev

    Fix available

    libxml2 fixed in 2.9.4+dfsg1-3.1; libxml2 fixed in 2.9.4+dfsg1-3.1; libxml2 fixed in 2.9.4+dfsg1-3.1

  4. Oct 14, 2026 · OSV.dev

    Fix available

    libxml2 fixed in 2.9.4+dfsg1-3.1

  5. Oct 14, 2026 · OSV.dev

    Updated

    parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Affected

  • Debian:12 libxml20 → 2.9.4+dfsg1-3.1
  • Debian:13 libxml20 → 2.9.4+dfsg1-3.1
  • Debian:14 libxml20 → 2.9.4+dfsg1-3.1
  • cpe xmlsoft/libxml2version unspecified

Sources

  • CVE.orgVulnerability recordCVE-2017-16931

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2017-16931

    30-day exploitation probability 4.6%

    first.org
  • NIST NVDVulnerability recordCVE-2017-16931

    parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2017-16931
    osv.dev

References