CVE-2016-9487: EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks
EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9487?
CVE-2016-9487 is considered a medium severity vulnerability due to its potential for reading arbitrary files and executing unintended requests.
How do I fix CVE-2016-9487?
To fix CVE-2016-9487, upgrade to a version of EpubCheck that addresses this vulnerability, as version 4.0.1 is affected.
What kind of attack does CVE-2016-9487 enable?
CVE-2016-9487 enables an attacker to exploit the parsing of XML in EPUB files to read arbitrary files on the victim's system.
Which software versions are affected by CVE-2016-9487?
The affected version of the software related to CVE-2016-9487 is EpubCheck 4.0.1.
Who is responsible for addressing CVE-2016-9487?
It is the responsibility of users and administrators of EpubCheck to ensure they apply necessary updates to mitigate CVE-2016-9487.