CVE-2016-9318CWE-611xxe

CVE-2016-9318

Medium · published November 16, 2016

CVSS v3.1
5.5
EPSS
3%
Percentile
86.9
In the wild
Unconfirmed
What it is

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02938 · 86.9th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2016-11-16T05:59Z
Affected products (5)
ProductVersionsFixed in
xmlsoft/libxml2≤ 2.9.4—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
References (15)
http://www.securityfocus.com/bid/94347 · [email protected]https://bugzilla.gnome.org/show_bug.cgi?id=772726 · [email protected]https://github.com/lsh123/xmlsec/issues/43 · [email protected]https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html · [email protected]https://security.gentoo.org/glsa/201711-01 · [email protected]https://usn.ubuntu.com/3739-1/ · [email protected]https://usn.ubuntu.com/3739-2/ · [email protected]http://www.securityfocus.com/bid/94347 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.gnome.org/show_bug.cgi?id=772726 · af854a3a-2127-422b-91ae-364da2661108https://github.com/lsh123/xmlsec/issues/43 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201711-01 · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/3739-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/3739-2/ · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 16 NOV 00:00Z
    libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be…
    cvelistv5