CVE-2016-9318

Published: 15 November 2016

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Priority

Low

CVSS 3 base score: 5.5

Status

Package Release Status
libxml2
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 18.04 LTS (Bionic Beaver)
Released (2.9.4+dfsg1-6.1ubuntu1.2)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (2.9.3+dfsg1-1ubuntu0.6)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (2.9.1+dfsg1-3ubuntu4.13)
Patches:
Upstream: https://git.gnome.org/browse/libxml2/commit/?id=ad88b54f1a28a8565964a370b5d387927b633c0d

Notes

AuthorNote
mdeslaur
patch introduced a new option that isn't enabled by default:
https://git.gnome.org/browse/libxml2/commit/?id=2304078555896cf1638c628f50326aeef6f0e0d0
commit was later reverted in
https://git.gnome.org/browse/libxml2/commit/?id=030b1f7a27c22f9237eddca49ec5e620b6258d7d

commit listed below is new patch to fix this issue

References

Bugs