| Name | CVE-2016-9318 |
| Description | libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2972-1, ELA-1195-1, ELA-1227-1 |
| Debian Bugs | 844581 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| libxml2 (PTS) | jessie, jessie (lts) | 2.9.1+dfsg1-5+deb8u17 | fixed |
| stretch (security) | 2.9.4+dfsg1-2.2+deb9u7 | fixed | |
| stretch (lts), stretch | 2.9.4+dfsg1-2.2+deb9u11 | fixed | |
| buster, buster (lts) | 2.9.4+dfsg1-7+deb10u9 | fixed | |
| buster (security) | 2.9.4+dfsg1-7+deb10u6 | vulnerable | |
| bullseye | 2.9.10+dfsg-6.7+deb11u4 | fixed | |
| bullseye (security) | 2.9.10+dfsg-6.7+deb11u5 | fixed | |
| bookworm | 2.9.14+dfsg-1.3~deb12u1 | fixed | |
| sid, trixie | 2.12.7+dfsg+really2.9.14-0.2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| libxml2 | source | experimental | 2.9.8+dfsg-1 | |||
| libxml2 | source | jessie | 2.9.1+dfsg1-5+deb8u17 | ELA-1227-1 | ||
| libxml2 | source | stretch | 2.9.4+dfsg1-2.2+deb9u6 | DLA-2972-1 | ||
| libxml2 | source | buster | 2.9.4+dfsg1-7+deb10u9 | ELA-1227-1 | ||
| libxml2 | source | (unstable) | 2.9.10+dfsg-2 | 844581 |
[buster] - libxml2 <ignored> (Minor issue; intrusive to backport)
[jessie] - libxml2 <ignored> (Minor issue; intrusive to backport)
[wheezy] - libxml2 <no-dsa> (Minor issue)
Upstream Bug: https://bugzilla.gnome.org/show_bug.cgi?id=772726
Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/2304078555896cf1638c628f50326aeef6f0e0d0
The patch introduces a new option that can be specified if this
behaviour is wanted. Not enforced by default.
The option though was reverted in https://gitlab.gnome.org/GNOME/libxml2/-/commit/030b1f7a27c22f9237eddca49ec5e620b6258d7d
New proposed/commited fix: https://gitlab.gnome.org/GNOME/libxml2/-/commit/ad88b54f1a28a8565964a370b5d387927b633c0d