CVE-2016-5851

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-5851
python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.openwall.com/lists/oss-security/2016/06/28/7 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/28/8 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/91485 Third Party Advisory VDB Entry
https://github.com/python-openxml/python-docx/blob/v0.8.6/HISTORY.rst Patch Release Notes Vendor Advisory
https://github.com/python-openxml/python-docx/commit/61b40b161b64173ab8e362aec1fd197948431beb
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4MGNRXXT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACTA2SWDZ/
http://www.openwall.com/lists/oss-security/2016/06/28/7 Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/28/8 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/91485 Third Party Advisory VDB Entry
https://github.com/python-openxml/python-docx/blob/v0.8.6/HISTORY.rst Patch Release Notes Vendor Advisory
https://github.com/python-openxml/python-docx/commit/61b40b161b64173ab8e362aec1fd197948431beb
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4MGNRXXT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACTA2SWDZ/
Configurations

Configuration 1 (hide)

cpe:2.3:a:python-openxml_project:python-docx:*:*:*:*:*:*:*:*
History

21 Nov 2024, 02:55

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2016/06/28/7 - Mailing List, Patch, Third Party Advisory () http://www.openwall.com/lists/oss-security/2016/06/28/7 - Mailing List, Patch, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2016/06/28/8 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2016/06/28/8 - Mailing List, Third Party Advisory
References () http://www.securityfocus.com/bid/91485 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/91485 - Third Party Advisory, VDB Entry
References () https://github.com/python-openxml/python-docx/blob/v0.8.6/HISTORY.rst - Patch, Release Notes, Vendor Advisory () https://github.com/python-openxml/python-docx/blob/v0.8.6/HISTORY.rst - Patch, Release Notes, Vendor Advisory
References () https://github.com/python-openxml/python-docx/commit/61b40b161b64173ab8e362aec1fd197948431beb - () https://github.com/python-openxml/python-docx/commit/61b40b161b64173ab8e362aec1fd197948431beb -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4MGNRXXT/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4MGNRXXT/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACTA2SWDZ/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACTA2SWDZ/ -

07 Dec 2023, 22:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4MGNRXXT/', 'name': 'FEDORA-2021-aa54748cd9', 'tags': ['Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACTA2SWDZ/', 'name': 'FEDORA-2021-aa6ebc01be', 'tags': ['Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACTA2SWDZ/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4MGNRXXT/ -
  • () https://github.com/python-openxml/python-docx/commit/61b40b161b64173ab8e362aec1fd197948431beb -

09 Sep 2021, 17:25

Type Values Removed Values Added
CPE cpe:2.3:a:python-openxml:python-docx:*:*:*:*:*:*:*:* cpe:2.3:a:python-openxml_project:python-docx:*:*:*:*:*:*:*:*
References (MLIST) http://www.openwall.com/lists/oss-security/2016/06/28/8 - Third Party Advisory (MLIST) http://www.openwall.com/lists/oss-security/2016/06/28/8 - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACTA2SWDZ/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACTA2SWDZ/ - Third Party Advisory
References (MLIST) http://www.openwall.com/lists/oss-security/2016/06/28/7 - Patch, Third Party Advisory (MLIST) http://www.openwall.com/lists/oss-security/2016/06/28/7 - Mailing List, Patch, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4MGNRXXT/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4MGNRXXT/ - Third Party Advisory

19 Aug 2021, 03:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4MGNRXXT/ -
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACTA2SWDZ/ -
Information

Published : 2016-12-21 22:59

Updated : 2025-04-12 10:46

NVD link : CVE-2016-5851

Mitre link : CVE-2016-5851

CVE.ORG link : CVE-2016-5851

JSON object : View

Products Affected

python-openxml_project

  • python-docx
CWE
CWE-611

Improper Restriction of XML External Entity Reference