Medium severity5.5NVD Advisory· Published Nov 16, 2016· Updated Jun 17, 2026

CVE-2016-9318

Description

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Xmlsoft/Libxml22 versions
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*range: <=2.9.4
- (no CPE)range: <=2.9.4
Canonical/Ubuntu Linux4 versions
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Xmlsec/xmlsecllm-fuzzy
Range: <=1.2.23
osv-coords34 versions
pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATA pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/libxml2-python&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/libxml2-python&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/libxml2-python&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATA pkg:rpm/suse/libxml2-python&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/libxml2-python&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4
< 2.9.1-26.12.1+ 33 more
- (no CPE)range: < 2.9.1-26.12.1
- (no CPE)range: < 2.9.4-33.1
- (no CPE)range: < 2.9.4-46.20.1
- (no CPE)range: < 2.7.6-0.69.1
- (no CPE)range: < 2.7.6-0.69.1
- (no CPE)range: < 2.7.6-0.69.1
- (no CPE)range: < 2.7.6-0.64.1
- (no CPE)range: < 2.9.1-26.12.1
- (no CPE)range: < 2.9.4-33.1
- (no CPE)range: < 2.9.4-46.20.1
- (no CPE)range: < 2.9.4-33.1
- (no CPE)range: < 2.7.6-0.64.1
- (no CPE)range: < 2.9.1-26.12.1
- (no CPE)range: < 2.9.4-33.1
- (no CPE)range: < 2.9.4-46.20.1
- (no CPE)range: < 2.7.6-0.64.1
- (no CPE)range: < 2.9.1-26.12.1
- (no CPE)range: < 2.9.4-33.1
- (no CPE)range: < 2.9.4-46.20.1
- (no CPE)range: < 2.7.6-0.69.3
- (no CPE)range: < 2.7.6-0.69.3
- (no CPE)range: < 2.7.6-0.69.3
- (no CPE)range: < 2.7.6-0.64.4
- (no CPE)range: < 2.7.6-0.64.4
- (no CPE)range: < 2.9.1-26.12.1
- (no CPE)range: < 2.9.4-33.1
- (no CPE)range: < 2.9.4-46.20.1
- (no CPE)range: < 2.9.1-26.12.1
- (no CPE)range: < 2.9.4-33.1
- (no CPE)range: < 2.9.4-46.20.1
- (no CPE)range: < 2.9.4-33.1
- (no CPE)range: < 2.9.1-26.12.1
- (no CPE)range: < 2.9.4-33.1
- (no CPE)range: < 2.9.4-46.20.1

Patches

Vulnerability mechanics

References

bugzilla.gnome.org/show_bug.cginvdIssue TrackingPatchThird Party AdvisoryVDB Entry
github.com/lsh123/xmlsec/issues/43nvdExploitPatchThird Party Advisory
www.securityfocus.com/bid/94347nvdThird Party AdvisoryVDB Entry
security.gentoo.org/glsa/201711-01nvdThird Party Advisory
usn.ubuntu.com/3739-1/nvdThird Party Advisory
usn.ubuntu.com/3739-2/nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2022/04/msg00004.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000