PT-2016-4390 · Apache+3 · Apache Xerces-C+3
Gustavo Grieco
·
Publicado
2016-02-25
·
Atualizado
2024-06-15
·
CVE-2016-0729
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Xerces-C versions prior to 3.1.3
Description
The issue is related to multiple buffer overflows in the XML Parser library, specifically in the internal/XMLReader.cpp, util/XMLURL.cpp, and util/XMLUri.cpp files. This can be exploited by remote attackers using a crafted document, potentially leading to a denial of service, such as a segmentation fault or memory corruption, or possibly allowing the execution of arbitrary code.
Recommendations
For Apache Xerces-C versions prior to 3.1.3, update to version 3.1.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XML Parser library until a patch is applied. Avoid processing crafted documents from untrusted sources to minimize the risk of exploitation.
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Xerces-C
Centos
Red Hat
Suse