Security advisory

{
  "id": "18a4448110556e986911203509df4f2d59fad4dfd92bb2dc5173bdfe237407f4",
  "url": "https://osv.dev/vulnerability/CVE-2016-15026",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2016-15026",
    "summary": "A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The patch is identified as 8c954e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier assigned to this vulnerability.",
    "evidence": "osv:CVE-2016-15026",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2016-15026",
      "aliases": [
        "CVE-2016-15026",
        "GHSA-4jx2-hvqw-93j9"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/3breadt/dd-plist",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "c9eea3f2b78585e0fd974e1e44aa31ad164cd359"
                },
                {
                  "fixed": "8c954e8d9f6f6863729e50105a8abf3f87fff74c"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:dd-plist_project:dd-plist:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.18"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "8c954e8d9f6f6863729e50105a8abf3f87fff74c"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "c9eea3f2b78585e0fd974e1e44aa31ad164cd359"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "dd-plist-1.18"
                  }
                ]
              }
            }
          ],
          "versions": [
            "dd-plist-1.17",
            "dd-plist-1.16"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-15026.json",
            "vanir_signatures": [
              {
                "id": "CVE-2016-15026-57eb8ac0",
                "digest": {
                  "length": 162,
                  "function_hash": "73818157104332655743734305318668487658"
                },
                "source": "https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c",
                "target": {
                  "file": "src/main/java/com/dd/plist/XMLPropertyListParser.java",
                  "function": "initDocBuilderFactory"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2016-15026-7303fdd7",
                "digest": {
                  "length": 238,
                  "function_hash": "271063577363156928844205919802326829115"
                },
                "source": "https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c",
                "target": {
                  "file": "src/main/java/com/dd/plist/XMLPropertyListParser.java",
                  "function": "parse"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2016-15026-8bde8b8d",
                "digest": {
                  "length": 497,
                  "function_hash": "295560464668469150273073711917167493982"
                },
                "source": "https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c",
                "target": {
                  "file": "src/main/java/com/dd/plist/XMLPropertyListParser.java",
                  "function": "getDocBuilder"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2016-15026-9be40edc",
                "digest": {
                  "length": 246,
                  "function_hash": "84196759086702326352057667526542304220"
                },
                "source": "https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c",
                "target": {
                  "file": "src/main/java/com/dd/plist/XMLPropertyListParser.java",
                  "function": "resolveEntity"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2016-15026-b17aac16",
                "digest": {
                  "length": 238,
                  "function_hash": "271063577363156928844205919802326829115"
                },
                "source": "https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c",
                "target": {
                  "file": "src/main/java/com/dd/plist/XMLPropertyListParser.java",
                  "function": "parse"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2016-15026-d53a9e2d",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "154911896651691659066614047089007333525",
                    "288904762415930939762016160230504585976",
                    "170724025471137522039665991575538022768",
                    "128195611283003956085999530999736042529",
                    "336038780350479206410207518256628404558",
                    "214778586371739129180048470290186052760",
                    "92273930438447614724095986035769461152",
                    "104080191159220040594950137681646628005",
                    "43665763489909549328341195293353238602",
                    "236315981987779014385794075853837338009",
                    "50237111245684656740358613084329515834",
                    "189698960561764864748111068795818110089",
                    "288696968380454899439737896412138981380",
                    "98958089463804606263813501255120396861",
                    "257122689100532031558752014366251332240",
                    "122339393279653980590629437825781955186",
                    "275318846930166628673316836913241031019",
                    "321099633839438791686078115350965346609",
                    "98202338607271692886870259291360560092",
                    "171300180067330278861596006982037052667",
                    "120512363601449848410898898414651475790",
                    "243845392582626440622470582767216856885",
                    "284706865079888253831891300959800471403",
                    "273356787388331824968974453424826149992",
                    "158962672578729372529708767969367409584",
                    "250337601179638173471837012255273722667",
                    "338300106518233547904991893982827581832",
                    "315534818560412095188990206378345087094",
                    "245379904336459745863939567063470713931",
                    "210620716367728926251145648727017701796",
                    "37658285068073842668822798302582672152",
                    "291897363865647450145935302805449405658",
                    "23015680672744412473253096332375960406",
                    "292484501579917063018693097664403513963",
                    "281029406429438253007897363487816369474",
                    "298561553491604974378074956338872313592",
                    "170265570485474799894518003612854395858",
                    "321885962760570547065202733582932568860",
                    "307676299899332476585584245588363172235",
                    "209421244795335554913006043598681452009",
                    "66264452883119672808393837573048511366",
                    "283836740789320954656828232964009427452",
                    "175951704646020278883056294052842081546",
                    "26003255014130169274027039694564342386",
                    "108587633537507210242609878158511307392"
                  ]
                },
                "source": "https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c",
                "target": {
                  "file": "src/main/java/com/dd/plist/XMLPropertyListParser.java"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2016-15026-ea4c22b5",
                "digest": {
                  "length": 212,
                  "function_hash": "37951755619349760367888361413720397244"
                },
                "source": "https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c",
                "target": {
                  "file": "src/main/java/com/dd/plist/XMLPropertyListParser.java",
                  "function": "parse"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-20T13:13:36Z"
          }
        }
      ],
      "modified": "2026-10-20T13:13:36.990106888Z",
      "provider": "osv",
      "references": [
        "https://github.com/3breadt/dd-plist/releases/tag/dd-plist-1.18",
        "https://vuldb.com/?ctiid.221486",
        "https://vuldb.com/?id.221486",
        "https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c",
        "https://github.com/3breadt/dd-plist/pull/26"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2016-15026",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 387347,
  "published_at": "2023-02-20T11:15:12.617+00:00"
}