[xml/sgml-pkgs] Bug#844581: libxml2: CVE-2016-9318
carnil at debian.org
Thu Nov 17 05:28:05 UTC 2016
Tags: security upstream
the following vulnerability was published for libxml2.
| libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and
| other products, does not offer a flag directly indicating that the
| current document may be read but other files may not be opened, which
| makes it easier for remote attackers to conduct XML External Entity
| (XXE) attacks via a crafted document.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
Please adjust the affected versions in the BTS as needed.
More information about the debian-xml-sgml-pkgs