CVE-2016-2099 Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML do...
CriticalCVSS 9.8
EPSS 6.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xerces-c(Debian:12) | < 3.1.3+debian-2 | 3.1.3+debian-2 |
| debian/xerces-c(Debian:13) | < 3.1.3+debian-2 | 3.1.3+debian-2 |
| debian/xerces-c(Debian:14) | < 3.1.3+debian-2 | 3.1.3+debian-2 |
| apache xerces-c++ | <= 3.1.3 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- Debian Security Tracker CVE-2016-2099 vendor-advisory
- openSUSE-SU-2016:1744 vendor-advisory
- openSUSE-SU-2016:1808 vendor-advisory
- openSUSE-SU-2016:2232 vendor-advisory
- DSA-3579 vendor-advisory
- [oss-security] 20160509 CVE-2016-2099: use-after-free in Xerces 3.1.3 mailing-list
- www.oracle.com
- 90502 vdb-entry
- issues.apache.org
- GLSA-201612-46 vendor-advisory
- bugs.debian.org issue-tracking