CVE-2017-7376: debian debian_linux
Vulnerability summary
CVE-2017-7376 is a high (CVSS 10.0) vulnerability in debian debian_linux. EPSS estimates a 23.16% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities.
Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 23% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 19-02-2018PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
23.16%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
Decrease -0.13 pp
From 23.29% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- libxml2< 2.9.4+dfsg1-3.1
- debian_linuxEOL8.0 | 9.0
Google1 product
- androidEOL4.4.4 | 5.0.2 | 5.1.1 | 6.0 | 6.0.1 | 7.0 | 7.1.1 | 7.1.2
Ubuntu1 product
- libxml2< 2.9.1+dfsg1-3ubuntu4.10 | < 2.9.3+dfsg1-1ubuntu0.3
Xmlsoft1 product
- libxml2< 2.9.5
4 vendors · 5 products
References
13 links
- git.gnome.org/browse/libxml2/commit/?id=5dca9eea1bd4263bfa4d037ab2443de1cd730f7eX Refsource CONFIRMPatchThird Party Advisory
- android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4X Refsource CONFIRMPatchThird Party Advisory