CVE-2016-9318 | BDVDB-2026-79304 Detail
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Description#
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: local.
Weaknesses#
- CWE-611 Improper Restriction of XML External Entity Reference
References#
- https://bugzilla.gnome.org/show_bug.cgi?id=772726
- https://github.com/lsh123/xmlsec/issues/43
- https://usn.ubuntu.com/3739-1/
- https://security.gentoo.org/glsa/201711-01
- http://www.securityfocus.com/bid/94347
- https://usn.ubuntu.com/3739-2/
- https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.