CVE-2016-3709: xmlsoft libxml2 Cross-site Scripting
CVSS: 6.1v3.1MediumModified
AliasesALPINE-CVE-2016-3709MGASA-2022-0290RHSA-2022:7715RHSA-2023:4767UBUNTU-CVE-2016-3709USN-5548-1DEBIAN-CVE-2016-3709
Published 28-07-2022Last modified 14-10-2026
Vulnerability summary
CVE-2016-3709 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in xmlsoft libxml2. EPSS estimates a 1.31% chance of exploitation in the next 30 days, higher than 70.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
1.31%
0%100%
Low · +0.42 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 28-07-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Possible cross-site scripting vulnerability in libxml after commit 960f0e2.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · Red hatEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.31%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
+0.42 pp
From 0.90% on 19-09-2026
19-09-202619-10-2026
EPSS score1.31%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (mail.gnome.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- libxml2< 0:2.9.7-15.el8 | < 0:2.9.7-13.el8_6.2
- libxml2-debuginfo< 0:2.9.7-15.el8 | < 0:2.9.7-13.el8_6.2
- libxml2-debugsource< 0:2.9.7-15.el8 | < 0:2.9.7-13.el8_6.2
- libxml2-devel< 0:2.9.7-15.el8 | < 0:2.9.7-13.el8_6.2
- python3-libxml2< 0:2.9.7-15.el8 | < 0:2.9.7-13.el8_6.2
Alpine1 product
- libxml2≥ 2.9.2, < 2.9.11-r0
Debian1 product
- libxml2< 2.9.12+dfsg-3
Mageia1 product
- libxml2< 2.9.10-7.5.mga8
Ubuntu1 product
- libxml2< 2.9.3+dfsg1-1ubuntu0.7+esm3 | < 2.9.4+dfsg1-6.1ubuntu1.7 | < 2.9.10+dfsg-5ubuntu0.20.04.4
Xmlsoft1 product
- libxml2≥ 2.9.2, < 2.9.11
6 vendors · 11 products
References
19 links- mail.gnome.org/archives/xml/2018-January/msg00010.htmlX Refsource MISCExploitMailing ListThird Party Advisory
