CVE-2016-4449

Published: Jun 9, 2016Modified: May 6, 2026

7.1

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Exploitability: 1.8 / Impact: 5.2

Source: NVD

Description

XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

Affected (6)

Products: Debian: Debian Linux · Canonical: Ubuntu Linux · Xmlsoft: Libxml2

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml2	Up to 2.9.3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (60)

http://jvn.jp/en/jp/JVN17535578/index.html

Source: secalert@redhat.com

http://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000066.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/05/25/2

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/90865

Source: secalert@redhat.com

http://www.securitytracker.com/id/1036348

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2994-1

Source: secalert@redhat.com

http://xmlsoft.org/news.html

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2016:1292

Source: secalert@redhat.com

https://git.gnome.org/browse/libxml2/commit/?id=b1d34de46a11323fccffa9fadeb33be670d602f5

Source: secalert@redhat.com

Vendor Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10170

Source: secalert@redhat.com

https://support.apple.com/HT206899

Source: secalert@redhat.com

https://support.apple.com/HT206901

Source: secalert@redhat.com

https://support.apple.com/HT206902

Source: secalert@redhat.com

https://support.apple.com/HT206903

Source: secalert@redhat.com

https://support.apple.com/HT206904

Source: secalert@redhat.com

https://support.apple.com/HT206905

Source: secalert@redhat.com

https://support.cybozu.com/ja-jp/article/9735

Source: secalert@redhat.com

https://www.debian.org/security/2016/dsa-3593

Source: secalert@redhat.com

https://www.tenable.com/security/tns-2016-18

Source: secalert@redhat.com

http://jvn.jp/en/jp/JVN17535578/index.html