CVE-2017-16931

Critical

Published: 23/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In libxml2 before version 2.9.5, there is an issue with handling parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Risk Assessment

Exploitation of this vulnerability may lead to improper data processing, potentially resulting in XML External Entity (XXE) attacks.

Recommendation

It is recommended to upgrade libxml2 to version 2.9.5 or later to mitigate this vulnerability.

Original NVD description (English source)

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.