CVE-2016-9487
EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks
- State
- Published
- Severity
- Not scored
- Published
- Jul 13, 2018
- Updated
- Aug 6, 2024
- Reserved
- Nov 21, 2016
Description
EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.
Scores
The record has no CVSS score.
Weaknesses
Affected Products
| Product | Versions |
|---|---|
EpubCheckEpubCheck |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.