CVE-2016-0729 Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial...
CriticalCVSS 9.8
EPSS 9.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xerces-c(Debian:12) | < 3.1.3+debian-1 | 3.1.3+debian-1 |
| debian/xerces-c(Debian:13) | < 3.1.3+debian-1 | 3.1.3+debian-1 |
| debian/xerces-c(Debian:14) | < 3.1.3+debian-1 | 3.1.3+debian-1 |
| samsung x14j firmware | = t-ms14jakucb-1102.5 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
References
- Debian Security Tracker CVE-2016-0729 vendor-advisory
- FEDORA-2016-9ff972ca42 third-party-advisory vendor-advisory
- FEDORA-2016-ae9ac16cf3 third-party-advisory vendor-advisory
- FEDORA-2016-880b91c090 third-party-advisory vendor-advisory
- openSUSE-SU-2016:0966 vendor-advisory
- openSUSE-SU-2016:1121 vendor-advisory
- openSUSE-SU-2016:1808 vendor-advisory
- packetstormsecurity.com
- svn.apache.org
- DSA-3493 third-party-advisory vendor-advisory
- www.oracle.com
- www.oracle.com
- 20160225 CVE-2016-0729: Apache Xerces-C XML Parser Crashes on Malformed Input mailing-list
- 83423 vdb-entry
- 1035113 vdb-entry
- xerces.apache.org vendor-advisory
- issues.apache.org vendor-advisory
- GLSA-201612-46 vendor-advisory
- www.oracle.com
- bugs.debian.org issue-tracking