Vulnerability Description
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xmlsoft | Libxml2 | <= 2.9.4 |
| Xmlsec Project | Xmlsec | <= 1.2.23 |
| Canonical | Ubuntu Linux | 12.04 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/94347Third Party AdvisoryVDB Entry
- https://bugzilla.gnome.org/show_bug.cgi?id=772726Issue TrackingPatchThird Party Advisory
- https://github.com/lsh123/xmlsec/issues/43ExploitPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
- https://security.gentoo.org/glsa/201711-01Third Party Advisory
- https://usn.ubuntu.com/3739-1/Third Party Advisory
- https://usn.ubuntu.com/3739-2/Third Party Advisory
- http://www.securityfocus.com/bid/94347Third Party AdvisoryVDB Entry
- https://bugzilla.gnome.org/show_bug.cgi?id=772726Issue TrackingPatchThird Party Advisory
- https://github.com/lsh123/xmlsec/issues/43ExploitPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
- https://security.gentoo.org/glsa/201711-01Third Party Advisory
- https://usn.ubuntu.com/3739-1/Third Party Advisory
- https://usn.ubuntu.com/3739-2/Third Party Advisory
FAQ
What is CVE-2016-9318?
CVE-2016-9318 is a vulnerability with a CVSS score of 5.5 (MEDIUM). libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, w...
How severe is CVE-2016-9318?
CVE-2016-9318 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-9318?
Check the references section above for vendor advisories and patch information. Affected products include: Xmlsoft Libxml2, Xmlsec Project Xmlsec, Canonical Ubuntu Linux.