Descriptionlibxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs844581

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libxml2 (PTS)wheezy2.8.0+dfsg1-7+wheezy5vulnerable
wheezy (security)2.8.0+dfsg1-7+wheezy9vulnerable
jessie (security)2.9.1+dfsg1-5+deb8u5vulnerable
stretch (security), stretch2.9.4+dfsg1-2.2+deb9u1vulnerable
buster, sid2.9.4+dfsg1-5vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[stretch] - libxml2 <no-dsa> (Minor issue)
[jessie] - libxml2 <no-dsa> (Minor issue)
[wheezy] - libxml2 <no-dsa> (Minor issue)
Upstream Bug:
Fixed by:
The patch introduces a new option that can be specified if this
behaviour is wanted. Not enforced by default.
The option though was reverted in

Search for package or bug name: Reporting problems