CVE-2016-4463 Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
HighCVSS 7.5
EPSS 14.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xerces-c(Debian:12) | < 3.1.3+debian-2.1 | 3.1.3+debian-2.1 |
| debian/xerces-c(Debian:13) | < 3.1.3+debian-2.1 | 3.1.3+debian-2.1 |
| debian/xerces-c(Debian:14) | < 3.1.3+debian-2.1 | 3.1.3+debian-2.1 |
| apache xerces-c++ | <= 3.1.3 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-4463 vendor-advisory
- openSUSE-SU-2016:1808 vendor-advisory
- openSUSE-SU-2016:2232 vendor-advisory
- packetstormsecurity.com
- www.oracle.com
- 20160629 CVE-2016-4463: Apache Xerces-C XML Parser Crashes on Malformed DTD mailing-list
- 91501 vdb-entry
- 1036211 vdb-entry
- xerces.apache.org
- RHSA-2018:3335 vendor-advisory
- RHSA-2018:3506 vendor-advisory
- RHSA-2018:3514 vendor-advisory
- issues.apache.org
- issues.apache.org
- DSA-3610 vendor-advisory
- www.oracle.com
- bugs.debian.org issue-tracking