Skip to content

CVE-2016-9487 EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks

HighCVSS 7.8 EPSS 1.3%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.

Affected products

ProductAffected versionsFixed in
w3 epubcheck = 4.0.1 No fix listed
EpubCheck = 4.0.1 No fix listed

References

  • VU#779243 third-party-advisory us-government-resource
  • 94864 third-party-advisory vdb-entry