CVE-2016-9318
- State
- Published
- Severity
- 5.5 Medium
- Published
- Nov 16, 2016
- Updated
- Oct 14, 2026
- Reserved
- Nov 14, 2016
Description
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-611 Improper Restriction of XML External Entity Reference
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://bugzilla.gnome.org/show_bug.cgi?id=772726
- https://github.com/lsh123/xmlsec/issues/43
- USN-3739-1vendor-advisory
- GLSA-201711-01vendor-advisory
- 94347vdb-entry
- USN-3739-2vendor-advisory
- [debian-lts-announce] 20220408 [SECURITY] [DLA 2972-1] libxml2 security updatemailing-list
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.