CVE-2016-10149

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-3759Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/01/19/5Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/97692
https://access.redhat.com/errata/RHSA-2017:0936
https://access.redhat.com/errata/RHSA-2017:0937
https://access.redhat.com/errata/RHSA-2017:0938
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716Issue Tracking, Patch, Third Party Advisory
https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9bIssue Tracking, Patch, Third Party Advisory
https://github.com/rohe/pysaml2/issues/366Issue Tracking, Patch, Third Party Advisory
https://github.com/rohe/pysaml2/pull/379Issue Tracking, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3759Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/01/19/5Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/97692
https://access.redhat.com/errata/RHSA-2017:0936
https://access.redhat.com/errata/RHSA-2017:0937
https://access.redhat.com/errata/RHSA-2017:0938
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716Issue Tracking, Patch, Third Party Advisory
https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9bIssue Tracking, Patch, Third Party Advisory
https://github.com/rohe/pysaml2/issues/366Issue Tracking, Patch, Third Party Advisory
https://github.com/rohe/pysaml2/pull/379Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Mar 24, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-10158.8Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows att CVE-2016-101509.8Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS CVE-2016-101517.0The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment CVE-2016-101529.8The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configurat CVE-2016-101537.8The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows loca CVE-2016-101545.5The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option,CVE-2016-101556.0Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (CVE-2016-101567.8A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowi CVE-2016-101579.8Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is ag CVE-2016-101587.5The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote atta CVE-2016-101597.5Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers CVE-2016-10168.8Use-after-free vulnerability in the Transform object implementation in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.