libxml2: Inappropriate fetch of entities content

🗓️ 15 Dec 2016 22:11:19Reported by RedHatType

libxml2 XXE in xmlStringLenDecodeEntities up to version 2.9.4 allows file access or denial of service when not in validating mode.

Reporter	Title	Published	Views	Family All 147
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libxml2 affect IBM RackSwitch Networking products	31 Jan 201902:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM Security Identity Governance	16 Jun 201821:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XML processing affect IBM DataPower Gateways	15 Jun 201807:06	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Systems Tester is affected by Libxml2 vulnerabilities (CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)	17 Jun 201805:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM MQ Appliance	13 Aug 201919:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	15 Jun 201823:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM Security Network Protection	16 Jun 201821:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM MQ Appliance	15 Jun 201807:06	–	ibm
IBM Security Bulletins	Security Bulletin: Libxml2 vulnerabilities affect IBM SmartCloud Entry	19 Jul 202000:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libxml2 affect PowerKVM	18 Jun 201801:33	–	ibm

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2016-4449
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2016-4449
cve	www.cve.org/CVERecord

14 May 2026 22:23Current

7.3High risk

Vulners AI Score7.3

CVSS 25.8

CVSS 37.1

EPSS0.01668