PT-2016-2301 · Apache+5 · Apache Xerces-C+5

Publicado 2016-06-29 · Atualizado 2024-06-15 · CVE-2016-4463

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Xerces-C++ versions prior to 3.1.4

Description The issue is a stack-based buffer overflow that allows context-dependent attackers to cause a denial of service via a deeply nested DTD. This can be exploited by a remote attacker to disrupt service using nested DTD files.

Recommendations For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of deeply nested DTD files to minimize the risk of exploitation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2016-1794

BDU:2016-01690

CESA-2018_3335

CVE-2016-4463

DLA-535-1

DSA-3610-1

MGASA-2016-0243

OPENSUSE-SU-2024:10039-1

RHSA-2018:3335

RHSA-2018:3506

RHSA-2018:3514

RHSA-2018_3335

SUSE-SU-2016:2154-1

SUSE-SU-2018:3277-1

SUSE-SU-2018_3277-1

USN-4784-1

Produtos afetados

Alt Linux

Apache Xerces-C

Centos

Red Hat

Suse

Ubuntu

Referências · 46

• http://securityfocus.com/archive/1/archive/1/538784/100/0/threaded · Nota
• https://osv.dev/vulnerability/DSA-3610-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2018:3277-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4463 · Aviso do Fabricante
• http://securitytracker.com/id/1036211 · Nota
• https://ubuntu.com/security/CVE-2017-12627 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-4463 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:3514 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10039-1 · Aviso do Fabricante
• https://issues.apache.org/jira/browse/XERCESC-2069 · Nota
• https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=10510&version=12336069 · Nota
• https://suse.com/security/cve/CVE-2016-2099 · Nota
• https://osv.dev/vulnerability/CVE-2016-4463 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4784-1 · Aviso do Fabricante
• http://securityfocus.com/bid/91501 · Nota