CVE-2016-9487 EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2016-9487?
CVE-2016-9487 is a high-severity vulnerability in EpubCheck, published on 13 Jul 2018.
Official description
EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.
Weakness: CWE-611
Which versions are affected by CVE-2016-9487?
It affects 1 product.
Products include W3 Epubcheck.
How do I fix CVE-2016-9487?
No fix has been published for CVE-2016-9487 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-9487 being exploited?
There is no known exploitation of CVE-2016-9487 in the wild and no public exploit code.
Sources
Also known as GHSA-vvh2-g87v-gg7j, UBUNTU-CVE-2016-9487.