CVE-2016-4449

Severity: high (CVSS 7.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-09 · updated 2026-06-17
Weakness: CWE-20

Description

XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 15.10, 16.04
Debian Linux: 8.0
xmlsoft libxml2: through 2.9.3

References

http://jvn.jp/en/jp/JVN17535578/index.html
http://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000066.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
http://rhn.redhat.com/errata/RHSA-2016-2957.html
http://www.openwall.com/lists/oss-security/2016/05/25/2
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Get alerted when CVE-2016-4449 or the next vulnerability affects your stack