CVE catalog

CVE-2016-9318

libxml2: CVE-2016-9318

[CVE catalog]

Severity
Medium · CVSS 6.7CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
2.94% · Oct 25, 2026

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxml2sid2.15.4+dfsg-1fixed
Debianlibxml2forky2.15.4+dfsg-1fixed
Debianlibxml2trixie2.12.7+dfsg+really2.9.14-2.1+deb13u3fixed
Debianlibxml2trixie-security2.12.7+dfsg+really2.9.14-2.1+deb13u1fixed
Debianlibxml2bookworm2.9.14+dfsg-1.3~deb12u6fixed
Debianlibxml2bookworm-security2.9.14+dfsg-1.3~deb12u4fixed
Cpelibxml2Not reportedNot reportedunknown
Cpeubuntu_linuxNot reportedNot reportedunknown
Alpinelibxml23.102.9.4-r2fixed
Alpinelibxml23.112.9.4-r2fixed
Alpinelibxml23.122.9.4-r2fixed
Alpinelibxml23.132.9.4-r2fixed
Alpinelibxml23.142.9.4-r2fixed
Alpinelibxml23.152.9.4-r2fixed
Alpinelibxml23.162.9.4-r2fixed
Alpinelibxml23.172.9.4-r2fixed
Alpinelibxml23.182.9.4-r2fixed
Alpinelibxml23.192.9.4-r2fixed
Alpinelibxml23.22.9.4-r2fixed
Alpinelibxml23.202.9.4-r2fixed
Alpinelibxml23.212.9.4-r2fixed
Alpinelibxml23.222.9.4-r2fixed
Alpinelibxml23.232.9.4-r2fixed
Alpinelibxml23.242.9.4-r2fixed
Alpinelibxml23.32.9.4-r2fixed
Alpinelibxml23.42.9.4-r2fixed
Alpinelibxml23.52.9.4-r2fixed
Alpinelibxml23.62.9.4-r2fixed
Alpinelibxml23.72.9.4-r2fixed
Alpinelibxml23.82.9.4-r2fixed
Alpinelibxml23.92.9.4-r2fixed
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu2vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu3vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.1vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.2vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.3vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.4vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.5vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.6vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.7vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.8vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.9vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.10vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.11vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.12vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.13fixed
Ubuntulibxml216.042.9.2+zdfsg1-4vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu1vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu2vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu3vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.1vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.2vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.3vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.4vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.5vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.6fixed
Ubuntulibxml218.042.9.4+dfsg1-4ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5ubuntu2vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5.1ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5.2ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-6.1ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-6.1ubuntu1.2fixed
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu2vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu3vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.1vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.2vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.3vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.4vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.5vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.6vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.7vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.8vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.9vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.10vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.11vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.12vulnerable
Ubuntulibxml214.042.9.1+dfsg1-3ubuntu4.13fixed
Ubuntulibxml216.042.9.2+zdfsg1-4vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu1vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu2vulnerable
Ubuntulibxml216.042.9.2+zdfsg1-4ubuntu3vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.1vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.2vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.3vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.4vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.5vulnerable
Ubuntulibxml216.042.9.3+dfsg1-1ubuntu0.6fixed
Ubuntulibxml218.042.9.4+dfsg1-4ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5ubuntu2vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5.1ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5.2ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-6.1ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-6.1ubuntu1.2fixed
Suselibxml2linux enterprise desktop 12 sp42.9.4-46.20.1fixed
Susepython-libxml2linux enterprise desktop 12 sp42.9.4-46.20.1fixed
Suselibxml2linux enterprise software development kit 12 sp42.9.4-46.20.1fixed
Suselibxml2linux enterprise server 12 sp42.9.4-46.20.1fixed
Susepython-libxml2linux enterprise server 12 sp42.9.4-46.20.1fixed
Suselibxml2linux enterprise server for sap applications 12 sp42.9.4-46.20.1fixed
Susepython-libxml2linux enterprise server for sap applications 12 sp42.9.4-46.20.1fixed
Suselibxml2linux enterprise software development kit 11 sp42.7.6-0.64.1fixed
Suselibxml2linux enterprise server 11 sp42.7.6-0.64.1fixed
Suselibxml2-pythonlinux enterprise server 11 sp42.7.6-0.64.4fixed
Suselibxml2linux enterprise server for sap applications 11 sp42.7.6-0.64.1fixed
Suselibxml2-pythonlinux enterprise server for sap applications 11 sp42.7.6-0.64.4fixed
Suselibxml2linux enterprise software development kit 11 sp42.7.6-0.69.1fixed
Suselibxml2linux enterprise point of sale 11 sp32.7.6-0.69.1fixed
Suselibxml2-pythonlinux enterprise point of sale 11 sp32.7.6-0.69.3fixed
Suselibxml2linux enterprise server 11 sp3-ltss2.7.6-0.69.1fixed
Suselibxml2-pythonlinux enterprise server 11 sp3-ltss2.7.6-0.69.3fixed
Suselibxml2linux enterprise server 11 sp3-teradata2.7.6-0.69.1fixed
Suselibxml2-pythonlinux enterprise server 11 sp3-teradata2.7.6-0.69.3fixed
Suselibxml2linux enterprise server 11 sp42.7.6-0.69.1fixed
Suselibxml2-pythonlinux enterprise server 11 sp42.7.6-0.69.3fixed
Suselibxml2linux enterprise server for sap applications 11 sp42.7.6-0.69.1fixed
Suselibxml2-pythonlinux enterprise server for sap applications 11 sp42.7.6-0.69.3fixed
Suselibxml2linux enterprise software development kit 11 sp42.7.6-0.77.15.1fixed
Suselibxml2linux enterprise point of sale 11 sp32.7.6-0.77.15.1fixed
Suselibxml2-pythonlinux enterprise point of sale 11 sp32.7.6-0.77.15.1fixed
Suselibxml2linux enterprise server 11 sp42.7.6-0.77.15.1fixed
Suselibxml2-pythonlinux enterprise server 11 sp42.7.6-0.77.15.1fixed
Suselibxml2linux enterprise server for sap applications 11 sp42.7.6-0.77.15.1fixed
Suselibxml2-pythonlinux enterprise server for sap applications 11 sp42.7.6-0.77.15.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxml2sourcesid2.9.10+dfsg-2not yet assignedNot reported[844581]
Debianlibxml2sourceforky2.9.10+dfsg-2not yet assignedNot reported[844581]
Debianlibxml2sourcetrixie2.9.10+dfsg-2not yet assignedNot reported[844581]
Debianlibxml2sourcebookworm2.9.10+dfsg-2not yet assignedNot reported[844581]
Alpinelibxml2apk3.102.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.112.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.122.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.132.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.142.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.152.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.162.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.172.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.182.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.192.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.22.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.202.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.212.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.222.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.232.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.242.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.32.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.42.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.52.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.62.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.72.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.82.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Alpinelibxml2apk3.92.9.4-r2Not reportedALPINE-CVE-2016-9318Not reported
Ubuntulibxml2deb14.042.9.1+dfsg1-3ubuntu4.13Not reportedUBUNTU-CVE-2016-9318Not reported
Ubuntulibxml2deb16.042.9.3+dfsg1-1ubuntu0.6Not reportedUBUNTU-CVE-2016-9318Not reported
Ubuntulibxml2deb18.042.9.4+dfsg1-6.1ubuntu1.2Not reportedUBUNTU-CVE-2016-9318Not reported
Ubuntulibxml2deb14.042.9.1+dfsg1-3ubuntu4.13Not reportedUSN-3739-1Not reported
Ubuntulibxml2deb16.042.9.3+dfsg1-1ubuntu0.6Not reportedUSN-3739-1Not reported
Ubuntulibxml2deb18.042.9.4+dfsg1-6.1ubuntu1.2Not reportedUSN-3739-1Not reported
Suselibxml2rpmlinux enterprise desktop 12 sp42.9.4-46.20.1Not reportedSUSE-SU-2019:1896-1Not reported
Susepython-libxml2rpmlinux enterprise desktop 12 sp42.9.4-46.20.1Not reportedSUSE-SU-2019:1896-1Not reported
Suselibxml2rpmlinux enterprise software development kit 12 sp42.9.4-46.20.1Not reportedSUSE-SU-2019:1896-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp42.9.4-46.20.1Not reportedSUSE-SU-2019:1896-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp42.9.4-46.20.1Not reportedSUSE-SU-2019:1896-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 12 sp42.9.4-46.20.1Not reportedSUSE-SU-2019:1896-1Not reported
Susepython-libxml2rpmlinux enterprise server for sap applications 12 sp42.9.4-46.20.1Not reportedSUSE-SU-2019:1896-1Not reported
Suselibxml2rpmlinux enterprise software development kit 11 sp42.7.6-0.64.1Not reportedSUSE-SU-2017:0164-1Not reported
Suselibxml2rpmlinux enterprise server 11 sp42.7.6-0.64.1Not reportedSUSE-SU-2017:0164-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 11 sp42.7.6-0.64.4Not reportedSUSE-SU-2017:0164-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 11 sp42.7.6-0.64.1Not reportedSUSE-SU-2017:0164-1Not reported
Suselibxml2-pythonrpmlinux enterprise server for sap applications 11 sp42.7.6-0.64.4Not reportedSUSE-SU-2017:0164-1Not reported
Suselibxml2rpmlinux enterprise software development kit 11 sp42.7.6-0.69.1Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2rpmlinux enterprise point of sale 11 sp32.7.6-0.69.1Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2-pythonrpmlinux enterprise point of sale 11 sp32.7.6-0.69.3Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2rpmlinux enterprise server 11 sp3-ltss2.7.6-0.69.1Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 11 sp3-ltss2.7.6-0.69.3Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2rpmlinux enterprise server 11 sp3-teradata2.7.6-0.69.1Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 11 sp3-teradata2.7.6-0.69.3Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2rpmlinux enterprise server 11 sp42.7.6-0.69.1Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 11 sp42.7.6-0.69.3Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 11 sp42.7.6-0.69.1Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2-pythonrpmlinux enterprise server for sap applications 11 sp42.7.6-0.69.3Not reportedSUSE-SU-2017:1557-1Not reported
Suselibxml2rpmlinux enterprise software development kit 11 sp42.7.6-0.77.15.1Not reportedSUSE-SU-2019:13985-1Not reported
Suselibxml2rpmlinux enterprise point of sale 11 sp32.7.6-0.77.15.1Not reportedSUSE-SU-2019:13985-1Not reported
Suselibxml2-pythonrpmlinux enterprise point of sale 11 sp32.7.6-0.77.15.1Not reportedSUSE-SU-2019:13985-1Not reported
Suselibxml2rpmlinux enterprise server 11 sp42.7.6-0.77.15.1Not reportedSUSE-SU-2019:13985-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 11 sp42.7.6-0.77.15.1Not reportedSUSE-SU-2019:13985-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 11 sp42.7.6-0.77.15.1Not reportedSUSE-SU-2019:13985-1Not reported
Suselibxml2-pythonrpmlinux enterprise server for sap applications 11 sp42.7.6-0.77.15.1Not reportedSUSE-SU-2019:13985-1Not reported

[Debian bug #844581]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libxml2]Unknown
    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

  • Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-2

      dsa · libxml2 · debian · bookworm

Observed:

References