# CVE-2016-4216: libxmpcore-java: XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackersto read arbitrary files via XML data contai...

CVE-2016-4216 is fixed in libxmpcore-java on 1 platform, first by libxmpcore-java 5.1.3-1, released July 12, 2016. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2016-4216
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0363
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 12, 2016

## Description

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackersto read arbitrary files via XML data containing an external entitydeclaration in conjunction with an entity reference, related to an XMLExternal Entity (XXE) issue.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libxmpcore-java Ubuntu 20.04 LTS (focal) | 5.1.3-1 | [libxmpcore-java 5.1.3-1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libxmpcore-java-5.1.3-1.md) | Jul 12, 2016 |
| Linux | libxmpcore-java Ubuntu 22.04.1 LTS (jammy) | 5.1.3-1 | [libxmpcore-java 5.1.3-1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libxmpcore-java-5.1.3-1.md) | Jul 12, 2016 |
| Linux | libxmpcore-java Ubuntu 24.04.5 LTS (noble) | 5.1.3-1 | [libxmpcore-java 5.1.3-1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libxmpcore-java-5.1.3-1.md) | Jul 12, 2016 |
| Linux | libxmpcore-java Ubuntu 24.10 (oracular) | 5.1.3-1 | [libxmpcore-java 5.1.3-1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libxmpcore-java-5.1.3-1.md) | Jan 16, 2026 |
| Linux | libxmpcore-java Ubuntu 25.04 (plucky) | 5.1.3-1 | [libxmpcore-java 5.1.3-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libxmpcore-java-5.1.3-1.md) | Jan 16, 2026 |
| Linux | libxmpcore-java Ubuntu 25.10 (questing) | 5.1.3-1 | [libxmpcore-java 5.1.3-1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libxmpcore-java-5.1.3-1.md) | Jul 12, 2016 |
| Linux | libxmpcore-java Ubuntu 26.04.1 LTS (resolute) | 5.1.3-1 | [libxmpcore-java 5.1.3-1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libxmpcore-java-5.1.3-1.md) | Jul 12, 2016 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo