CVE catalog

CVE-2017-5969

libxml2: CVE-2017-5969

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.63% · Oct 25, 2026

libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxml2sid2.15.4+dfsg-1fixed
Debianlibxml2forky2.15.4+dfsg-1fixed
Debianlibxml2trixie2.12.7+dfsg+really2.9.14-2.1+deb13u3fixed
Debianlibxml2trixie-security2.12.7+dfsg+really2.9.14-2.1+deb13u1fixed
Debianlibxml2bookworm2.9.14+dfsg-1.3~deb12u6fixed
Debianlibxml2bookworm-security2.9.14+dfsg-1.3~deb12u4fixed
Ubuntulibxml2pro2.9.2+zdfsg1-4vulnerable
Ubuntulibxml2pro2.9.2+zdfsg1-4ubuntu1vulnerable
Ubuntulibxml2pro2.9.2+zdfsg1-4ubuntu2vulnerable
Ubuntulibxml2pro2.9.2+zdfsg1-4ubuntu3vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.1vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.2vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.3vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.4vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.5vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.6vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm1vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm2vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm3vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm4vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm5vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm6vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm7vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm8vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm9vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm10vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm11vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm12vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm13vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm14vulnerable
Alpinelibxml23.102.9.4-r4fixed
Alpinelibxml23.112.9.4-r4fixed
Alpinelibxml23.122.9.4-r4fixed
Alpinelibxml23.132.9.4-r4fixed
Alpinelibxml23.142.9.4-r4fixed
Alpinelibxml23.152.9.4-r4fixed
Alpinelibxml23.162.9.4-r4fixed
Alpinelibxml23.172.9.4-r4fixed
Alpinelibxml23.182.9.4-r4fixed
Alpinelibxml23.192.9.4-r4fixed
Alpinelibxml23.22.9.4-r3fixed
Alpinelibxml23.202.9.4-r4fixed
Alpinelibxml23.212.9.4-r4fixed
Alpinelibxml23.222.9.4-r4fixed
Alpinelibxml23.232.9.4-r4fixed
Alpinelibxml23.242.9.4-r4fixed
Alpinelibxml23.32.9.4-r3fixed
Alpinelibxml23.42.9.4-r3fixed
Alpinelibxml23.52.9.4-r3fixed
Alpinelibxml23.62.9.4-r4fixed
Alpinelibxml23.72.9.4-r4fixed
Alpinelibxml23.82.9.4-r4fixed
Alpinelibxml23.92.9.4-r4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxml2sourcesid2.9.4+dfsg1-5.1not yet assignedNot reported[855001]
Debianlibxml2sourceforky2.9.4+dfsg1-5.1not yet assignedNot reported[855001]
Debianlibxml2sourcetrixie2.9.4+dfsg1-5.1not yet assignedNot reported[855001]
Debianlibxml2sourcebookworm2.9.4+dfsg1-5.1not yet assignedNot reported[855001]
Alpinelibxml2apk3.102.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.112.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.122.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.132.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.142.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.152.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.162.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.172.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.182.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.192.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.22.9.4-r3Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.202.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.212.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.222.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.232.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.242.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.32.9.4-r3Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.42.9.4-r3Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.52.9.4-r3Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.62.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.72.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.82.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported
Alpinelibxml2apk3.92.9.4-r4Not reportedALPINE-CVE-2017-5969Not reported

[Debian bug #855001]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libxml2]Unknown
    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [python3-libxml2]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

[Debian 13 (Trixie)]

  • [libxml2]Unknown
    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · all · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · all · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

  • [python3-libxml2]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.9.4+dfsg1-5.1

      dsa · libxml2 · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]