CVE-2016-4434: XEE
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
Other sources
Apache Tika parses XML within numerous file formats. In some instances, such as spreadsheets in OOXML files, XMP in PDF, and other file formats, the initialization of the XML parser or the choice of handlers did not protect against XML External Entity (XXE) vulnerabilities.
References:
http://seclists.org/oss-sec/2016/q2/413
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4434?
CVE-2016-4434 has a high severity score due to the potential for remote XML External Entity (XXE) attacks.
How do I fix CVE-2016-4434?
To fix CVE-2016-4434, upgrade Apache Tika to version 1.13 or later.
What is the exploit type associated with CVE-2016-4434?
CVE-2016-4434 is associated with XML External Entity (XXE) attacks.
Which versions of Apache Tika are affected by CVE-2016-4434?
Apache Tika versions prior to 1.13, including 1.12, are affected by CVE-2016-4434.
What could be the impact of exploiting CVE-2016-4434?
Exploiting CVE-2016-4434 may allow attackers to access sensitive data or potentially execute arbitrary commands on the server.