CVE-2016-9318 XML external entity in n/a
Remote attackers can exploit libxml2's lack of strict file access controls to perform XML External Entity attacks, potentially reading sensitive files or causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-9318?
CVE-2016-9318 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 16 Nov 2016. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
Weakness: CWE-611
Which versions are affected by CVE-2016-9318?
It affects 2 products.
Linux distribution packages (12)
libxml2 SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 2.9.4-46.20.1 |
python-libxml2 SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 2.9.4-46.20.1 |
libxml2 SUSE:Linux Enterprise Server 11 SP4 | All versions | 2.7.6-0.64.1 |
libxml2-python SUSE:Linux Enterprise Server 11 SP4 | All versions | 2.7.6-0.64.4 |
libxml2 SUSE:Linux Enterprise Server 12 SP4 | All versions | 2.9.4-46.20.1 |
python-libxml2 SUSE:Linux Enterprise Server 12 SP4 | All versions | 2.9.4-46.20.1 |
libxml2 SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 2.7.6-0.64.1 |
libxml2-python SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 2.7.6-0.64.4 |
libxml2 SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 2.9.4-46.20.1 |
python-libxml2 SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 2.9.4-46.20.1 |
libxml2 SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 2.7.6-0.64.1 |
libxml2 SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 2.9.4-46.20.1 |
Products include Canonical Ubuntu Linux, Xmlsoft Libxml2.
How do I fix CVE-2016-9318?
Upgrade to a fixed version.
Is CVE-2016-9318 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-9318 exists.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2016-9318, DEBIAN-CVE-2016-9318, ECHO-fe6c-b039-a615, SUSE-SU-2017:0164-1, SUSE-SU-2019:1896-1, UBUNTU-CVE-2016-9318.