PyPI/python-docx CVE-2016-5851: unknown, EPSS 2.35%

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Action: Upgrade python-docx to 0.8.6 or later.

pip install python-docx==0.8.6

Affected

Fixed versions

Sources

• osv: PYSEC-2016-21
• https://github.com/python-openxml/python-docx/blob/v0.8.6/HISTORY.rst
• http://www.securityfocus.com/bid/91485
• http://www.openwall.com/lists/oss-security/2016/06/28/8
• http://www.openwall.com/lists/oss-security/2016/06/28/7
• https://github.com/advisories/GHSA-34wj-p5jm-2p96

CVE-2016-5851 · published 2016-12-21T22:59:00Z · modified 2023-11-08T03:58:32.000630Z · JSON