CVE-2017-9233: debian debian_linux
Vulnerability summary
CVE-2017-9233 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 8.74% chance of exploitation in the next 30 days, higher than 95.1% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 25-07-2017PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
8.74%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 8.74% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (libexpat.github.io)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
- CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu8 products
- cableswigAll versions (No fix recorded)
- coin3< 3.1.4~abc9f50-4ubuntu2+esm1 | < 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1 | All versions (No fix recorded)
- expat< 2.1.0-4ubuntu1.4 | < 2.1.0-7ubuntu0.16.04.3
- insighttoolkit4All versions (No fix recorded)
- matanzaAll versions (No fix recorded)
Debian3 products
- expat< 2.2.1-1 | < 2.1.0-6+deb8u4 | < 2.2.0-2+deb9u1 | < 2.1.0-1+deb7u5
- libxmltokAll versions (No fix recorded)
- debian_linuxEOL8.0 | 9.0 | 10.0
Alpine1 product
- expat< 2.2.0-r1
Libexpat_project1 product
- libexpat≤ 2.2.0
Python1 product
- python≥ 2.7.0, < 2.7.15 | ≥ 3.3.0, < 3.3.7 | ≥ 3.4.0, < 3.4.7 | ≥ 3.5.0, < 3.5.4 | ≥ 3.6.0, < 3.6.2
5 vendors · 14 products
References
20 links- libexpat.github.io/doc/cve-2017-9233/X Refsource CONFIRMExploitTechnical DescriptionVendor AdvisoryREPORT
- github.com/libexpat/libexpat/blob/master/expat/ChangesX Refsource CONFIRMRelease NotesThird Party Advisory
