CVE-2017-16931

Description

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libxml2	2.9.4+dfsg1-3.1	—
Debian 13	libxml2	2.9.4+dfsg1-3.1	—
Debian 12	libxml2	2.9.4+dfsg1-3.1	—
Debian 7	libxml2	2.8.0+dfsg1-7+wheezy11	DLA-1194-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.6	libxml2	2.9.5-r0	—
Alpine v3.5	libxml2	2.9.5-r0	—
Alpine v3.4	libxml2	2.9.5-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	libxml2 +3	2.9.1-6.amzn2.3.3	ALAS2-2019-1301

Advisories 6

SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
DLA-1194-1 libxml2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
WID-SEC-2023-1158 libxml2: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jun 30, 2025
WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
ALAS2-2019-1301 Moderate: libxml2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 2, 2019

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference functi…