CVE-2016-9318

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-9318
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9318.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-9318
Downstream
ALPINE (1)
BELL (1)
DEBIAN (1)
MGASA (1)
SUSE (8)
UBUNTU (1)
Related
SUSE (8)
Published
2016-11-16T00:59:00Z
Modified
2026-10-22T02:45:23Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "last_affected": "2.9.4"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "xmlsoft:libxml2"
        },
        {
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "12.04"
                        },
                        {
                            "last_affected": "12.04"
                        },
                        {
                            "introduced": "14.04"
                        },
                        {
                            "last_affected": "14.04"
                        },
                        {
                            "introduced": "16.04"
                        },
                        {
                            "last_affected": "16.04"
                        },
                        {
                            "introduced": "18.04"
                        },
                        {
                            "last_affected": "18.04"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "canonical:ubuntu_linux"
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "last_affected": "2.9.4"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/lsh123/xmlsec

Affected ranges

Type
GIT
Repo
https://github.com/lsh123/xmlsec
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
0dcb578db2c1073460958a1d08fafc379c747c98
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "1.2.23"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

Other
XMLSEC_0211104
XMLSEC_0_0_X_START
XMLSEC_1_2_X_START
XMLSEC_MIGRATION_TO_GITHUB
XMLSEC_MSCRYPTO_083103_START
start
xmlsec-
xmlsec-0_0_10
xmlsec-0_0_5
xmlsec-0_0_7
xmlsec-0_0_8
xmlsec-0_0_8a
xmlsec-0_0_9
xmlsec-0_1_0
xmlsec-0_1_1
xmlsec-1_0_0
xmlsec-1_0_0pre1
xmlsec-1_0_0rc1
xmlsec-1_0_1
xmlsec-1_0_2
xmlsec-1_0_3
xmlsec-1_0_4
xmlsec-1_1_0
xmlsec-1_1_1
xmlsec-1_1_2
xmlsec-1_2_0
xmlsec-1_2_1
xmlsec-1_2_10
xmlsec-1_2_11
xmlsec-1_2_13
xmlsec-1_2_14
xmlsec-1_2_15
xmlsec-1_2_16
xmlsec-1_2_17
xmlsec-1_2_18
xmlsec-1_2_19
xmlsec-1_2_2
xmlsec-1_2_20
xmlsec-1_2_21
xmlsec-1_2_22
xmlsec-1_2_23
xmlsec-1_2_3
xmlsec-1_2_4
xmlsec-1_2_5
xmlsec-1_2_6
xmlsec-1_2_7
xmlsec-1_2_8
xmlsec-1_2_9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9318.json"