CVE-2017-10672: debian debian_linux Use After Free
Vulnerability summary
CVE-2017-10672 is a critical (CVSS 9.8) Use After Free vulnerability in debian debian_linux. EPSS estimates a 7.93% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 29-06-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
7.93%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 7.93% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (rt.cpan.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse12 products
- perl-XML-LibXML&distro=SUSE Linux Enterprise Desktop 12 SP2< 2.0019-6.3.5
- perl-XML-LibXML&distro=SUSE Linux Enterprise Desktop 12 SP3< 2.0019-6.3.5
- perl-XML-LibXML&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 1.66-3.3.1
- perl-XML-LibXML&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 1.66-3.3.1
- perl-XML-LibXML&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA< 1.66-3.3.1
Debian2 products
- libxml-libxml-perl< 2.0128+dfsg-5 | < 2.0116+dfsg-1+deb8u2 | < 2.0128+dfsg-1+deb9u1 | < 2.0001+dfsg-1+deb7u2
- debian_linuxEOL8.0 | 9.0
Mageia2 products
- perl-XML-LibXML< 2.12.100-1.1.mga5
- perl-XML-LibXML< 2.12.900-1.1.mga6
Ubuntu1 product
- libxml-libxml-perl< 2.0108+dfsg-1ubuntu0.2 | < 2.0123+dfsg-1ubuntu0.1
Xml-libxml_project1 product
- xml-libxml≤ 2.0129
5 vendors · 18 products
References
14 links
- lists.debian.org/debian-lts-announce/2017/11/msg00017.htmlMailing ListX Refsource MLISTThird Party Advisory
- rt.cpan.org/Public/Bug/Display.html?id=122246X Refsource MISCExploitMailing ListThird Party Advisory