CVE-2017-7375

Vulnerability

CVE-2017-7375 is a flaw in libxml2 [2] where the XML parser processes external entities even when the caller does not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes [1]. Affected versions include all prior to 2.9.4-r3 [2]. This enables XML External Entity (XXE) injection under default parser flags, which normally prevent such attacks [1].

Exploitation

An attacker must provide a specially crafted XML document [2] and entice a user or application to parse it with libxml2's default flags [1]. No special authentication or network position is required beyond delivering the payload. The XXE attack proceeds by including a malicious DOCTYPE declaration with an external entity pointing to a local file, HTTP, or FTP URL [1].

Impact

Successful exploitation leads to disclosure of local file contents, or interaction with internal HTTP/FTP servers that may be otherwise unreachable [1]. This can expose sensitive data, credentials, or internal service information. In some contexts, the attacker may achieve remote code execution or denial of service [2]. The compromise occurs at the privilege level of the application using libxml2.

Mitigation

Upgrade to libxml2 version 2.9.4-r3 or later, as released for Gentoo on 2017-11-01 [2]. The Android security bulletin of June 2017 also includes the fix [1]. No known workaround exists [2]; systems using unpatched libxml2 should apply the update immediately.