CVE-2017-16931
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DT
Published Nov 23, 2017 · updated Oct 14, 2026 · xmlsoft libxml2
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
Timeline
Detection, updates, and resolution for this record.
Nov 23, 2017 · NIST NVD
Detected
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
Oct 14, 2026 · NIST NVD
Updated
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
Oct 14, 2026 · OSV.dev
Fix available
libxml2 fixed in 2.9.4+dfsg1-3.1; libxml2 fixed in 2.9.4+dfsg1-3.1; libxml2 fixed in 2.9.4+dfsg1-3.1
Oct 14, 2026 · OSV.dev
Fix available
libxml2 fixed in 2.9.4+dfsg1-3.1
Oct 14, 2026 · OSV.dev
Updated
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
Affected
- Debian:12 libxml20 → 2.9.4+dfsg1-3.1
- Debian:13 libxml20 → 2.9.4+dfsg1-3.1
- Debian:14 libxml20 → 2.9.4+dfsg1-3.1
- cpe xmlsoft/libxml2version unspecified
Sources
- CVE.orgCVE-2017-16931
Official CVE identifier
cve.org - NIST NVDCVE-2017-16931
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
nvd.nist.gov - OSV.devDEBIAN-CVE-2017-16931osv.dev