CVE-2016-9318

Name
CVE-2016-9318
Description
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Third Party Advisory http://www.securityfocus.com/bid/94347
Issue Tracking https://bugzilla.gnome.org/show_bug.cgi?id=772726
Exploit https://github.com/lsh123/xmlsec/issues/43
cve@mitre.org https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
Third Party Advisory https://security.gentoo.org/glsa/201711-01
Third Party Advisory https://usn.ubuntu.com/3739-1/
Third Party Advisory https://usn.ubuntu.com/3739-2/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* libxml2 >= None <= 2.9.4

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libxml2.13 edge-main 2.9.4-r2 None fixed
libxml2 edge-main 2.9.4-r4 None fixed
libxml2 edge-main 2.9.4-r2 None fixed
libxml2 edge-main 2.9.4-r1 None possibly vulnerable
libxml2 3.22-main 2.9.4-r4 None fixed
libxml2 3.22-main 2.9.4-r2 None fixed
libxml2 3.22-main 2.9.4-r1 None possibly vulnerable
libxml2 3.21-main 2.9.4-r4 None fixed
libxml2 3.21-main 2.9.4-r2 None fixed
libxml2 3.21-main 2.9.4-r1 None possibly vulnerable
libxml2 3.20-main 2.9.4-r4 None fixed
libxml2 3.20-main 2.9.4-r2 None fixed
libxml2 3.20-main 2.9.4-r1 None possibly vulnerable
libxml2 3.19-main 2.9.4-r4 None fixed
libxml2 3.19-main 2.9.4-r2 None fixed
libxml2 3.19-main 2.9.4-r1 None possibly vulnerable
libxml2 3.18-main 2.9.4-r2 None fixed
libxml2 3.17-main 2.9.4-r2 None fixed
libxml2 3.12-main 2.9.4-r2 None fixed
libxml2 3.11-main 2.9.4-r2 None fixed
libxml2 3.10-main 2.9.4-r2 None fixed