PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2017-9233

CVE-2017-9233

expat: Inifinite loop due to invalid XML in external entity

Loading…

Severity

Moderate

Red Hat Product Security

7.5

CVSS 3.0

Review impact separately from score.

Published · June 14, 2017

Updated · May 15, 2026

Description

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Do not parse untrusted arbitrary XML data using the expat package.

CVSS / CWE

CVSS 3.0 · 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')