CVE-2016-9318
בינונית 5.5
תיאור (מקור, אנגלית)
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
מדדים
- CVSS 3.1
-
5.5 (MEDIUM)
מקור הציון: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - EPSS — סבירות ניצול
- 3% (אחוזון 100) נכון ל-14/10/2026
- CWE
- CWE-611
מוצרים מושפעים
xmlsoft: libxml2; xmlsec_project: xmlsec; canonical: ubuntu linux
קישורים
- https://bugzilla.gnome.org/show_bug.cgi?id=772726 Issue TrackingPatchThird Party AdvisoryVDB Entry
- https://github.com/lsh123/xmlsec/issues/43 ExploitPatchThird Party Advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=772726 Issue TrackingPatchThird Party AdvisoryVDB Entry
- https://github.com/lsh123/xmlsec/issues/43 ExploitPatchThird Party Advisory
- http://www.securityfocus.com/bid/94347 Third Party AdvisoryVDB Entry
- https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
- https://security.gentoo.org/glsa/201711-01 Third Party Advisory
- https://usn.ubuntu.com/3739-1/ Third Party Advisory
- https://usn.ubuntu.com/3739-2/ Third Party Advisory
- http://www.securityfocus.com/bid/94347 Third Party AdvisoryVDB Entry