CVE-2016-9318
En bref Sévérité MEDIUM 5.5 EPSS EPSS 2.94 % · centile 87 (2026-10-27) État PUBLISHED Publiée 2016-11-16 Mise à jour 2026-10-14 Attribuée par mitre Statut NVD Modified Description libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CISA-ADP CVSS 3.1 MEDIUM 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 3.1 MEDIUM 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 MEDIUM 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* ≤ 2.9.4cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*Produits affectés Produit Versions affected n/a
Références
Sources
