CVE-2016-9318

Priority
Description
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other
products, does not offer a flag directly indicating that the current
document may be read but other files may not be opened, which makes it
easier for remote attackers to conduct XML External Entity (XXE) attacks
via a crafted document.
Notes
 mdeslaur> patch introduced a new option that isn't enabled by default:
 mdeslaur> https://git.gnome.org/browse/libxml2/commit/?id=2304078555896cf1638c628f50326aeef6f0e0d0
 mdeslaur> commit was later reverted in
 mdeslaur> https://git.gnome.org/browse/libxml2/commit/?id=030b1f7a27c22f9237eddca49ec5e620b6258d7d
 mdeslaur>
 mdeslaur> commit listed below is new patch to fix this issue
Assigned-to
leosilva
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):released (2.7.8.dfsg-5.1ubuntu4.21)
Ubuntu 14.04 LTS (Trusty Tahr):released (2.9.1+dfsg1-3ubuntu4.13)
Ubuntu 16.04 LTS (Xenial Xerus):released (2.9.3+dfsg1-1ubuntu0.6)
Ubuntu 18.04 LTS (Bionic Beaver):released (2.9.4+dfsg1-6.1ubuntu1.2)
Ubuntu 18.10 (Cosmic Cuttlefish):released (2.9.4+dfsg1-7ubuntu1)
Patches:
Upstream:https://git.gnome.org/browse/libxml2/commit/?id=ad88b54f1a28a8565964a370b5d387927b633c0d
More Information

Updated: 2019-01-14 22:28:05 UTC (commit 51f9b73af244ba86b9321e46e526586c25a8e060)