Vulnerability Description
EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| W3 | Epubcheck | 4.0.1 |
Related Weaknesses (CWE)
References
- https://www.kb.cert.org/vuls/id/779243Third Party AdvisoryUS Government Resource
- https://www.securityfocus.com/bid/94864/Third Party AdvisoryVDB Entry
- https://www.kb.cert.org/vuls/id/779243Third Party AdvisoryUS Government Resource
- https://www.securityfocus.com/bid/94864/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2016-9487?
CVE-2016-9487 is a vulnerability with a CVSS score of 7.8 (HIGH). EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit t...
How severe is CVE-2016-9487?
CVE-2016-9487 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-9487?
Check the references section above for vendor advisories and patch information. Affected products include: W3 Epubcheck.