What is the severity of CVE-2016-9487?

CVE-2016-9487 is considered a medium severity vulnerability due to its potential for reading arbitrary files and executing unintended requests.

How do I fix CVE-2016-9487?

To fix CVE-2016-9487, upgrade to a version of EpubCheck that addresses this vulnerability, as version 4.0.1 is affected.

What kind of attack does CVE-2016-9487 enable?

CVE-2016-9487 enables an attacker to exploit the parsing of XML in EPUB files to read arbitrary files on the victim's system.

Which software versions are affected by CVE-2016-9487?

The affected version of the software related to CVE-2016-9487 is EpubCheck 4.0.1.

Who is responsible for addressing CVE-2016-9487?

It is the responsibility of users and administrators of EpubCheck to ensure they apply necessary updates to mitigate CVE-2016-9487.

Vulnerability/
CVE-2016-9487

high

7.8

CWE

611

13/7/2018

6/8/2024

CVE-2016-9487: EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks

First published: Fri Jul 13 2018(Updated: )

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.

Credit: cret@cert.org

Affected Software	Affected Version	How to fix
W3 Epubcheck	=4.0.1

Remedy

EpubCheck has released version 4.0.2 to address the vulnerability.

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2016-9487?
CVE-2016-9487 is considered a medium severity vulnerability due to its potential for reading arbitrary files and executing unintended requests.
How do I fix CVE-2016-9487?
To fix CVE-2016-9487, upgrade to a version of EpubCheck that addresses this vulnerability, as version 4.0.1 is affected.
What kind of attack does CVE-2016-9487 enable?
CVE-2016-9487 enables an attacker to exploit the parsing of XML in EPUB files to read arbitrary files on the victim's system.
Which software versions are affected by CVE-2016-9487?
The affected version of the software related to CVE-2016-9487 is EpubCheck 4.0.1.
Who is responsible for addressing CVE-2016-9487?
It is the responsibility of users and administrators of EpubCheck to ensure they apply necessary updates to mitigate CVE-2016-9487.

collector/nvd-index
agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/remedy
agent/last-modified-date
agent/title
agent/severity
agent/weakness
agent/author
agent/description
agent/first-publish-date
agent/event
agent/tags
agent/source
vendor/w3
canonical/w3 epubcheck
version/w3 epubcheck/4.0.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.