CVE-2016-4449high
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
References
http://jvn.jp/en/jp/JVN17535578/index.html
http://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000066.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
http://rhn.redhat.com/errata/RHSA-2016-2957.html
http://www.openwall.com/lists/oss-security/2016/05/25/2
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/90865
http://www.securitytracker.com/id/1036348
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
http://www.ubuntu.com/usn/USN-2994-1
https://access.redhat.com/errata/RHSA-2016:1292
https://git.gnome.org/browse/libxml2/commit/?id=b1d34de46a11323fccffa9fadeb33be670d602f5
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709
https://kc.mcafee.com/corporate/index?page=content&id=SB10170
https://support.apple.com/HT206899
https://support.apple.com/HT206901
https://support.apple.com/HT206902
https://support.apple.com/HT206903
https://support.apple.com/HT206904
https://support.apple.com/HT206905
https://support.cybozu.com/ja-jp/article/9735
Details
Source: MITRE
Published: 2016-06-09
Updated: 2018-01-18
Type: CWE-20
Risk Information
CVSS v2
Base Score: 5.8
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P
Impact Score: 4.9
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3
Base Score: 7.1
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Impact Score: 5.2
Exploitability Score: 1.8
Severity: HIGH
Vulnerable Software
Configuration 1
OR
Configuration 2
OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Configuration 3
OR
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* versions up to 2.9.3 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 121070 | Junos OS: Multiple vulnerabilities in libxml2 (JSA10916) | Nessus | Junos Local Security Checks | critical |
| 99492 | Fedora 24 : libxml2 (2017-be8574d593) | Nessus | Fedora Local Security Checks | critical |
| 99491 | Fedora 25 : libxml2 (2017-a3a47973eb) | Nessus | Fedora Local Security Checks | critical |
| 97893 | Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities | Nessus | Misc. | critical |
| 95940 | F5 Networks BIG-IP : libxml2 vulnerabilities (K24322529) | Nessus | F5 Networks Local Security Checks | high |
| 93154 | SUSE SLES11 Security Update : libxml2 (SUSE-SU-2016:1604-1) | Nessus | SuSE Local Security Checks | critical |
| 93145 | FreeBSD : libxml2 -- multiple vulnerabilities (e195679d-045b-4953-bb33-be0073ba2ac6) | Nessus | FreeBSD Local Security Checks | high |
| 9441 | Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities | Nessus Network Monitor | Operating System Detection | critical |
| 92497 | Mac OS X 10.9.5 and 10.10.5 Multiple Vulnerabilities (Security Update 2016-004) | Nessus | MacOS X Local Security Checks | critical |
| 92496 | Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
| 92494 | Apple TV < 9.2.2 Multiple Vulnerabilities | Nessus | Misc. | critical |
| 92411 | Apple iTunes < 12.4.2 Multiple Vulnerabilities (uncredentialed check) | Nessus | Peer-To-Peer File Sharing | critical |
| 92410 | Apple iTunes < 12.4.2 Multiple Vulnerabilities (credentialed check) | Nessus | Windows | critical |
| 92359 | Apple iOS < 9.3.3 Multiple Vulnerabilities | Nessus | Mobile Devices | critical |
| 92221 | Amazon Linux AMI : libxml2 (ALAS-2016-719) | Nessus | Amazon Linux Local Security Checks | critical |
| 91808 | Scientific Linux Security Update : libxml2 on SL6.x, SL7.x i386/x86_64 (20160623) | Nessus | Scientific Linux Local Security Checks | critical |
| 91802 | RHEL 6 / 7 : libxml2 (RHSA-2016:1292) | Nessus | Red Hat Local Security Checks | critical |
| 91800 | OracleVM 3.3 / 3.4 : libxml2 (OVMSA-2016-0087) | Nessus | OracleVM Local Security Checks | critical |
| 91797 | Oracle Linux 6 / 7 : libxml2 (ELSA-2016-1292) | Nessus | Oracle Linux Local Security Checks | critical |
| 91786 | CentOS 6 / 7 : libxml2 (CESA-2016:1292) | Nessus | CentOS Local Security Checks | critical |
| 91656 | SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:1538-1) | Nessus | SuSE Local Security Checks | critical |
| 91639 | openSUSE Security Update : libxml2 (openSUSE-2016-733) | Nessus | SuSE Local Security Checks | critical |
| 91499 | Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : libxml2 vulnerabilities (USN-2994-1) | Nessus | Ubuntu Local Security Checks | high |
| 91472 | Debian DLA-503-1 : libxml2 security update | Nessus | Debian Local Security Checks | high |
| 91447 | Debian DSA-3593-1 : libxml2 - security update | Nessus | Debian Local Security Checks | high |
| 91353 | Slackware 14.0 / 14.1 / current : libxml2 (SSA:2016-148-01) | Nessus | Slackware Local Security Checks | critical |