Critical severity9.8NVD Advisory· Published Jun 29, 2017· Updated Jun 17, 2026

CVE-2017-10672

Description

Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.

Affected products

XML Libxml Project/XML Libxml
cpe:2.3:a:xml-libxml_project:xml-libxml:*:*:*:*:*:perl:*:*
Range: <=2.0129
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Perl Foundation/XML-LibXMLllm-create
Range: <=2.0129
osv-coords12 versions
pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATA pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3
< 2.0019-6.3.5+ 11 more
- (no CPE)range: < 2.0019-6.3.5
- (no CPE)range: < 2.0019-6.3.5
- (no CPE)range: < 1.66-3.3.1
- (no CPE)range: < 1.66-3.3.1
- (no CPE)range: < 1.66-3.3.1
- (no CPE)range: < 1.66-3.3.1
- (no CPE)range: < 2.0019-6.3.5
- (no CPE)range: < 2.0019-6.3.5
- (no CPE)range: < 2.0019-6.3.5
- (no CPE)range: < 1.66-3.3.1
- (no CPE)range: < 2.0019-6.3.5
- (no CPE)range: < 2.0019-6.3.5

Patches

Vulnerability mechanics

References

rt.cpan.org/Public/Bug/Display.htmlnvdExploitMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2017/11/msg00017.htmlnvdThird Party Advisory
www.debian.org/security/2017/dsa-4042nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000