CVE-2016-9318
Published: 15 November 2016
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
Notes
| Author | Note |
|---|---|
| mdeslaur | patch introduced a new option that isn't enabled by default: https://git.gnome.org/browse/libxml2/commit/?id=2304078555896cf1638c628f50326aeef6f0e0d0 commit was later reverted in https://git.gnome.org/browse/libxml2/commit/?id=030b1f7a27c22f9237eddca49ec5e620b6258d7d commit listed below is new patch to fix this issue |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libxml2 Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Released
(2.9.4+dfsg1-6.1ubuntu1.2)
|
|
| precise |
Ignored
(end of life)
|
|
| trusty |
Released
(2.9.1+dfsg1-3ubuntu4.13)
|
|
| upstream |
Released
(2.9.8)
|
|
| xenial |
Released
(2.9.3+dfsg1-1ubuntu0.6)
|
|
| yakkety |
Ignored
(end of life)
|
|
| zesty |
Ignored
(end of life)
|
|
|
Patches: upstream: https://git.gnome.org/browse/libxml2/commit/?id=ad88b54f1a28a8565964a370b5d387927b633c0d |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.5 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |