XML external entity (XXE) vulnerability

[Sami32]

Following the official security report:
https://www.exploit-db.com/exploits/45146/

In case you was not aware of the Cling maintainer answer:
4thline/seamless#9 (comment)

[mseeley]

Thanks @Sami32, we followed up internally about this issue. We'll finish this off updating our app.

[mseeley]

From my investigation we don't build a libxml2 or libxslt dependency for Plex Media Player.

@Sami32 the security report you mentioned links to a Plex Media Server exploit. Did you by chance open this issue as a general notification to us that our server had an issue and not that the player built out of this repository had an issue?

Plex Media Server itself shipped a fix for CVE-2018-13415 in 1.13.6 on Aug 22, 2018.

[Sami32]

Yes, it was a general notification.

Oh i wasn't that you did fixed this issue already +1
Sorry for the noise :/

[mseeley]

No worries at all. We appreciate you looking out for our software and our users!