PT-2016-3441 · Xmlsoft+3 · Libxml2+3

Matias Brutti · Publicado 2016-10-06 · Atualizado 2022-04-08 · CVE-2016-9318

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.9.4 and earlier

Description The issue is related to the incorrect restriction of XML links to external objects, making it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document. This allows a remote attacker to access confidential data.

Recommendations For libxml2 versions 2.9.4 and earlier, consider disabling the XML External Entity (XXE) processing until a patch is available. Restrict access to sensitive files and data to minimize the risk of exploitation.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2023-00220

CVE-2016-9318

DLA-2972-1

MGASA-2018-0048

SUSE-SU-2017:0164-1

SUSE-SU-2017:0380-1

SUSE-SU-2017:1366-1

SUSE-SU-2017:1557-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

SUSE-SU-2017_0164-1

SUSE-SU-2017_1557-1

SUSE-SU-2019:13985-1

SUSE-SU-2019:1896-1

SUSE-SU-2019_13985-1

SUSE-SU-2019_1896-1

USN-3739-1

USN-3739-2

Produtos afetados

Astra Linux

Suse

Ubuntu

Libxml2

Referências · 81

• 🔥 https://github.com/lsh123/xmlsec/issues/43 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2016-9318 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2018-0048 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14567 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-updates/2017-07/msg00000.html · Nota
• https://bugzilla.suse.com/1039066 · Nota
• https://bugzilla.suse.com/1017497 · Nota
• https://ubuntu.com/security/notices/USN-3739-1 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-updates/2017-02/msg00055.html · Nota
• https://advisories.mageia.org/MGASA-2018-0048.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-0191 · Nota
• https://bugzilla.suse.com/1039069 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2019:1896-1 · Aviso do Fabricante
• http://securityfocus.com/bid/94347 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20191896-1 · Nota