CVE-2016-9180 perl-XML-Twig: The option to expand_external_ents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's set...
CriticalCVSS 9.1
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
perl-XML-Twig: The option to expand_external_ents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxml-twig-perl(Debian:12) | < 1:3.50-1.1 | 1:3.50-1.1 |
| debian/libxml-twig-perl(Debian:13) | < 1:3.50-1.1 | 1:3.50-1.1 |
| debian/libxml-twig-perl(Debian:14) | < 1:3.50-1.1 | 1:3.50-1.1 |
| xmltwig xml-twig for perl | All versions | No fix listed |
References
- Debian Security Tracker CVE-2016-9180 vendor-advisory
- openSUSE-SU-2020:1177 vendor-advisory
- openSUSE-SU-2020:1204 vendor-advisory
- [oss-security] 20161104 Re: CVE request: XXE in perl Image:nfo and XML:wig mailing-list third-party-advisory
- 94219 third-party-advisory vdb-entry
- bugs.debian.org issue-tracking