CVE-2016-9180 XML external entity in n/a
The Perl XML::Twig library fails to disable external entity expansion, allowing attackers to trigger XXE attacks for data disclosure or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9180?
CVE-2016-9180 is a critical vulnerability in n/a, published on 22 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.
Weakness: CWE-611
Which versions are affected by CVE-2016-9180?
It affects 1 product.
Linux distribution packages (21)
perl-XML-Twig SUSE:HPE Helion OpenStack 8 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 3.52-3.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 3.52-3.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:OpenStack Cloud 7 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:OpenStack Cloud 8 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:OpenStack Cloud 9 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:OpenStack Cloud Crowbar 8 | All versions | 3.44-5.3.1 |
perl-XML-Twig SUSE:OpenStack Cloud Crowbar 9 | All versions | 3.44-5.3.1 |
perl-XML-Twig openSUSE:Leap 15.1 | All versions | 3.52-lp151.3.3.1 |
perl-XML-Twig openSUSE:Leap 15.2 | All versions | 3.52-lp152.4.3.1 |
perl-XML-Twig openSUSE:Tumbleweed | All versions | 3.52-2.8 |
Products include Xmltwig Xml-Twig for Perl.
How do I fix CVE-2016-9180?
Apply the vendor's patch.
Is CVE-2016-9180 being exploited?
There is no known exploitation of CVE-2016-9180 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2016-9180, GHSA-6wjc-jvcr-hcxw, SUSE-SU-2020:2172-1, SUSE-SU-2020:2173-1, SUSE-SU-2020:2173-2, UBUNTU-CVE-2016-9180 and 3 more.