CVE-2016-4449 XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrar...
HighCVSS 7.1
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxml2(Debian:12) | < 2.9.3+dfsg1-1.1 | 2.9.3+dfsg1-1.1 |
| debian/libxml2(Debian:13) | < 2.9.3+dfsg1-1.1 | 2.9.3+dfsg1-1.1 |
| debian/libxml2(Debian:14) | < 2.9.3+dfsg1-1.1 | 2.9.3+dfsg1-1.1 |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| xmlsoft libxml2 | <= 2.9.3 | No fix listed |
References
- Debian Security Tracker CVE-2016-4449 vendor-advisory
- JVN#17535578 third-party-advisory
- JVNDB-2017-000066 third-party-advisory
- APPLE-SA-2016-07-18-1 vendor-advisory
- APPLE-SA-2016-07-18-2 vendor-advisory
- APPLE-SA-2016-07-18-3 vendor-advisory
- APPLE-SA-2016-07-18-4 vendor-advisory
- APPLE-SA-2016-07-18-6 vendor-advisory
- RHSA-2016:2957 vendor-advisory
- [oss-security] 20160525 3 libxml2 issues mailing-list
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 90865 vdb-entry
- 1036348 vdb-entry
- SSA:2016-148-01 vendor-advisory
- USN-2994-1 vendor-advisory
- xmlsoft.org
- RHSA-2016:1292 vendor-advisory
- git.gnome.org vendor-advisory
- h20566.www2.hpe.com
- kc.mcafee.com
- support.apple.com
- support.apple.com
- support.apple.com
- support.apple.com
- support.apple.com
- support.apple.com
- support.cybozu.com
- DSA-3593 vendor-advisory
- www.tenable.com