CVE-2016-4449: Input Validation
A vulnerability was found in the libxml2 library. The parser would fetch content of an external entity while not in validating mode.
References:
https://bugzilla.gnome.org/showbug.cgi?id=761430
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=b1d34de46a11323fccffa9fadeb33be670d602f5
Other sources
XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4449?
CVE-2016-4449 has a severity rating that suggests it can lead to potential denial of service attacks due to improper handling of external entities in the libxml2 parser.
How do I fix CVE-2016-4449?
To fix CVE-2016-4449, upgrade to libxml2 versions 2.9.4+dfsg1-7+deb10u4 or higher for Debian and the corresponding patched versions for other distributions.
Which platforms are affected by CVE-2016-4449?
CVE-2016-4449 affects Debian Linux versions 8.0, Ubuntu versions 12.04, 14.04, 15.10, and 16.04, as well as libxml2 versions up to 2.9.3.
What type of vulnerability is CVE-2016-4449?
CVE-2016-4449 is an XML external entity (XXE) vulnerability that arises from improper parsing behavior in the libxml2 library.
Is CVE-2016-4449 a critical vulnerability?
CVE-2016-4449 is not classified as critical but poses significant risk as it can be exploited for denial of service.