CVE-2016-9318
At a glance Severity MEDIUM 5.5 EPSS EPSS 2.94 % · percentile 87 (2026-10-27) State PUBLISHED Published 2016-11-16 Updated 2026-10-14 Assigner mitre NVD status Modified Description libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CISA-ADP CVSS 3.1 MEDIUM 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 3.1 MEDIUM 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 MEDIUM 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* ≤ 2.9.4cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*Affected products Product Versions affected n/a
References
Sources
