{"id":"CVE-2016-9318","aliases":["ALPINE-CVE-2016-9318","BELL-CVE-2016-9318","DEBIAN-CVE-2016-9318","DLA-2972-1","EUVD-2016-10128","MGASA-2018-0048","SUSE-SU-2017:0164-1","SUSE-SU-2017:0380-1","SUSE-SU-2017:1366-1","SUSE-SU-2017:1557-1","SUSE-SU-2017:2699-1","SUSE-SU-2017:2700-1","SUSE-SU-2019:13985-1","SUSE-SU-2019:1896-1","UBUNTU-CVE-2016-9318","USN-3739-1"],"status":"published","title":"CVE-2016-9318 does not affect BellSoft software","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02938,"percentile":0.872,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2016-11-15T00:00:00Z","modified":"2026-10-24T10:47:22Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.2","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libxml2","fixed_in":["2.9.4-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxml2","fixed_in":["2.7.6-0.64.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2","fixed_in":["2.7.6-0.64.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2-python","fixed_in":["2.7.6-0.64.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2","fixed_in":["2.7.6-0.64.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2-python","fixed_in":["2.7.6-0.64.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libxml2","fixed_in":["2.9.4-46.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"python-libxml2","fixed_in":["2.9.4-46.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libxml2","fixed_in":["2.9.4-46.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libxml2","fixed_in":["2.9.4-46.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"python-libxml2","fixed_in":["2.9.4-46.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libxml2","fixed_in":["2.9.4-46.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"python-libxml2","fixed_in":["2.9.4-46.20.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","fixed_in":["2.9.1+dfsg1-3ubuntu4.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-2.2+deb9u6"}]}],"versions":["2.9.4+dfsg1-2.2","2.9.4+dfsg1-2.2+deb9u1","2.9.4+dfsg1-2.2+deb9u2","2.9.4+dfsg1-2.2+deb9u3","2.9.4+dfsg1-2.2+deb9u4","2.9.4+dfsg1-2.2+deb9u5"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-1.mga5"}]}],"bundled":14},{"source":"osv","ecosystem":"Mageia:5","package":"perl-XML-LibXML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.100-1.2.mga5"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.64.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.64.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.64.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.64.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.64.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-26.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-26.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-26.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-26.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-26.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-26.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-26.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.69.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.20.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.6"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.2"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.6"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.2"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1"],"bundled":5}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=772726","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"https://github.com/lsh123/xmlsec/issues/43","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/3739-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201711-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/94347","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://usn.ubuntu.com/3739-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-9318","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-9318","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9318","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0048.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19695","tags":["report"]},{"url":"https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html","tags":["web"]},{"url":"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-02/msg00055.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-06/msg00022.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-07/msg00000.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-07/msg00040.html","tags":["web"]},{"url":"https://usn.ubuntu.com/usn/usn-3513-1/","tags":["web"]},{"url":"https://usn.ubuntu.com/usn/usn-3504-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170164-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1010675","tags":["report"]},{"url":"https://bugzilla.suse.com/1014873","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9318","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170380-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1005544","tags":["report"]},{"url":"https://bugzilla.suse.com/1013930","tags":["report"]},{"url":"https://bugzilla.suse.com/1017497","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9597","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171366-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/876652","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171557-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1039063","tags":["report"]},{"url":"https://bugzilla.suse.com/1039064","tags":["report"]},{"url":"https://bugzilla.suse.com/1039066","tags":["report"]},{"url":"https://bugzilla.suse.com/1039069","tags":["report"]},{"url":"https://bugzilla.suse.com/1039661","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9050","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172699-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056193","tags":["report"]},{"url":"https://bugzilla.suse.com/975726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9233","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3731","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913985-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1102046","tags":["report"]},{"url":"https://bugzilla.suse.com/1110146","tags":["report"]},{"url":"https://bugzilla.suse.com/1126613","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14404","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191896-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9318","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3739-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3739-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14567","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.","status":"published","published":"2016-11-16T00:00:00Z","modified":"2026-10-14T06:25:30.491Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-10128","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.","status":"published","published":"2016-11-16T00:00:00Z","modified":"2026-10-14T06:25:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:17.902641Z"}],"nvd":[{"id":"CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.","status":"published","published":"2016-11-16T00:59:00.18Z","modified":"2026-10-14T07:16:38.733Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:03:32.086916Z"}],"osv":[{"id":"ALPINE-CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.","status":"published","published":"2016-11-16T00:59:00.18Z","modified":"2026-09-22T06:17:50.249787217Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2016-9318","title":"CVE-2016-9318 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:29.215249Z","modified":"2026-01-26T09:48:12.99023Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.","status":"published","published":"2016-11-16T00:59:00.18Z","modified":"2026-10-24T10:47:22.802850124Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.","status":"published","published":"2016-11-16T00:59:00.18Z","modified":"2026-10-14T11:47:26.009185869Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2016-9318","description":"libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.","status":"published","published":"2016-11-15T00:00:00Z","modified":"2026-04-22T11:03:50.833937Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-2972-1","title":"libxml2 - security update","status":"published","published":"2022-04-08T00:00:00Z","modified":"2026-03-09T01:19:45.17266Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2018-0048","title":"Updated libxml2 \u0026 perl-XML-LibXML packages fix security vulnerabilities","description":"Use-after-free error could lead to crash (CVE-2016-4658).\n\nUse-after-free vulnerability in libxml2 through 2.9.4 allows remote\nattackers to cause a denial of service or possibly have unspecified\nother impact via vectors related to the XPointer range-to function\n(CVE-2016-5131).\n\nlibxml2 2.9.4 and earlier does not offer a flag directly indicating that\nthe current document may be read but other files may not be opened,\nwhich makes it easier for remote attackers to conduct XML External\nEntity (XXE) attacks via a crafted document (CVE-2016-9318).\n\nHeap buffer overflow in xmlAddID (CVE-2017-0663).\n\nInteger overflow in memory debug code in libxml2 before 2.9.5\n(CVE-2017-5130).\n\nNULL pointer deref in xmlDumpElementContent (CVE-2017-5969).\n\nPrevent unwanted external entity reference (CVE-2017-7375).\n\nIncrease buffer space for port in HTTP redirect support (CVE-2017-7376).\n\nThe function xmlSnprintfElementContent in valid.c was vulnerable to a\nstack buffer overflow (CVE-2017-9047, CVE-2017-9048).\n\nThe function xmlDictComputeFastKey in dict.c was vulnerable to a\nheap-based buffer over-read (CVE-2017-9049).\n\nThe function xmlDictAddString was vulnerable to a heap-based buffer\nover-read (CVE-2017-9050).\n\nIt was discovered that libxml2 incorrecty handled certain files. An\nattacker could use this issue with specially constructed XML data to\ncause libxml2 to consume resources, leading to a denial of service\n(CVE-2017-15412).\n\nWei Lei discovered that libxml2 incorrecty handled certain parameter\nentities. An attacker could use this issue with specially constructed\nXML data to cause libxml2 to consume resources, leading to a denial of\nservice (CVE-2017-16932).\n\nThe libxml2 package has been updated to version 2.9.7 to fix these\nissues and several other bugs.\n","status":"published","published":"2018-01-03T15:50:51Z","modified":"2026-04-16T06:24:17.80338112Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:0164-1","title":"Security update for libxml2","description":"\nThis update for libxml2 fixes the following issues:\n\n* CVE-2016-9318: libxml2 did not offer a flag directly indicating that the current document may be read but other files may not be opened, which made it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document (bsc#1010675).\n* Prevent NULL dereference in xpointer.c and xmlDumpElementContent, and infinite recursion in xmlParseConditionalSections when in recovery mode(bnc#1014873)\n","status":"published","published":"2017-01-16T15:24:02Z","modified":"2026-02-04T02:47:09.882961Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0380-1","title":"Security update for libxml2","description":"\nThis update for libxml2 fixes the following issues:\n\n* CVE-2016-4658: use-after-free error could lead to crash [bsc#1005544]\n* Fix NULL dereference in xpointer.c when in recovery mode [bsc#1014873]\n* CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not detected by the recursion limits, allowing for DoS (bsc#1017497).\n\nFor CVE-2016-9318 we decided not to ship a fix since it can break existing setups. Please take appropriate actions if you parse untrusted XML files\nand use the new -noxxe flag if possible (bnc#1010675, bnc#1013930).\n","status":"published","published":"2017-02-03T17:46:15Z","modified":"2026-02-04T02:35:54.107111Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1366-1","title":"Security update for libxml2","description":"\n This update for libxml2 fixes the following issues:\n \n* Fix NULL dereference in xpointer.c when in recovery mode [bsc#1014873]\n* CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not detected by the recursion limits, allowing for DoS (bsc#1017497)\n* CVE-2014-0191: External parameter entity loaded when entity substitution is disabled could cause a DoS. (bsc#876652)\n* CVE-2016-9318: XML External Entity (XXE) could be abused via crafted document. (bsc#1010675)\n \n ","status":"published","published":"2017-05-22T08:37:33Z","modified":"2026-02-04T02:47:01.823614Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1557-1","title":"Security update for libxml2","description":"\nThis update for libxml2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-9050: heap-based buffer overflow (xmlDictAddString func) [bsc#1039069, bsc#1039661]\n- CVE-2017-9049: heap-based buffer overflow (xmlDictComputeFastKey func) [bsc#1039066]\n- CVE-2017-9048: stack overflow vulnerability (xmlSnprintfElementContent func) [bsc#1039063]\n- CVE-2017-9047: stack overflow vulnerability (xmlSnprintfElementContent func) [bsc#1039064]\n\nA clarification for the previously released update: For CVE-2016-9318 we decided\nnot to ship a fix since it can break existing setups. Please take appropriate\nactions if you parse untrusted XML files and use the new -noxxe flag if\npossible (bnc#1010675, bnc#1013930).\n","status":"published","published":"2017-06-13T13:19:39Z","modified":"2026-02-04T02:32:06.372345Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:2699-1","title":"Security update for SLES 12 Docker image","description":"The SUSE Linux Enterprise Server 12 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nutil-linux:\n\n- CVE-2015-5218\n- CVE-2016-5011\n- CVE-2017-2616\n\ncracklib:\n\n- CVE-2016-6318\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- openldap2\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:24Z","modified":"2026-02-04T03:24:03.922844Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2700-1","title":"Security update for SLES 12-SP1 Docker image","description":"The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nexpat:\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n- CVE-2016-7056\n- CVE-2016-8610\n- CVE-2017-3731\n\ncracklib:\n\n- CVE-2016-6318\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nutil-linux:\n\n- CVE-2016-5011\n- CVE-2017-2616\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\nupdate-alternatives:\n\n- CVE-2015-0860\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- lua51\n- lvm2\n- netcfg\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- sg3_utils\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:36Z","modified":"2026-02-04T03:03:17.897778Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2019:13985-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()\n  function when parsing an invalid XPath expression in the XPATH_OP_AND or\n  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046)\n\nOther Issue fixed:\n\n- Fixed a bug related to the fix for CVE-2016-9318 which allowed xsltproc to access \n  the internet even when --nonet was given and also was making docbook-xsl-stylesheets to have \n  incomplete xml catalog file (bsc#1010675, bsc#1126613 and bsc#1110146).\n","status":"published","published":"2019-03-21T17:41:21Z","modified":"2025-05-02T04:05:39.570657Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:1896-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\nIssue fixed:\n\n- Fixed a bug related to the fix for CVE-2016-9318 which allowed xsltproc to access \n  the internet even when --nonet was given and also was making docbook-xsl-stylesheets to have \n  incomplete xml catalog file (bsc#1010675, bsc#1126613 and bsc#1110146).\n","status":"published","published":"2019-07-18T14:26:53Z","modified":"2026-02-04T03:20:57.263003Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-3739-1","title":"libxml2 vulnerabilities","description":"Matias Brutti discovered that libxml2 incorrectly handled certain XML files.\nAn attacker could possibly use this issue to expose sensitive information.\n(CVE-2016-9318)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2017-16932)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2017-18258, CVE-2018-14404, CVE-2018-14567)\n","status":"published","published":"2018-08-14T17:28:27Z","modified":"2026-04-22T09:48:27.757606Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}