CVE-2016-4216
libxmpcore-java: XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackersto read arbitrary files via XML data contai...
CVE-2016-4216 is fixed in libxmpcore-java on 1 platform, first by libxmpcore-java 5.1.3-1, released July 12, 2016. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0363
89th percentile
XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackersto read arbitrary files via XML data containing an external entitydeclaration in conjunction with an entity reference, related to an XMLExternal Entity (XXE) issue.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libxmpcore-java · Ubuntu 20.04 LTS (focal) | 5.1.3-1 | libxmpcore-java 5.1.3-1 | Jul 12, 2016 |
| libxmpcore-java · Ubuntu 22.04.1 LTS (jammy) | 5.1.3-1 | libxmpcore-java 5.1.3-1 | Jul 12, 2016 |
| libxmpcore-java · Ubuntu 24.04.5 LTS (noble) | 5.1.3-1 | libxmpcore-java 5.1.3-1 | Jul 12, 2016 |
| libxmpcore-java · Ubuntu 24.10 (oracular) | 5.1.3-1 | libxmpcore-java 5.1.3-1 | Jan 16, 2026 |
| libxmpcore-java · Ubuntu 25.04 (plucky) | 5.1.3-1 | libxmpcore-java 5.1.3-1 | Jan 16, 2026 |
| libxmpcore-java · Ubuntu 25.10 (questing) | 5.1.3-1 | libxmpcore-java 5.1.3-1 | Jul 12, 2016 |
| libxmpcore-java · Ubuntu 26.04.1 LTS (resolute) | 5.1.3-1 | libxmpcore-java 5.1.3-1 | Jul 12, 2016 |