PT-2016-5016 · Apache+3 · Apache Xerces-C+3

Gustavo Grieco · Publicado 2016-05-13 · Atualizado 2024-06-15 · CVE-2016-2099

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Xerces C++ versions 3.1.3 and earlier

Description A use-after-free issue exists in the validators/DTD/DTDScanner.cpp component, allowing context-dependent attackers to have an unspecified impact by including an invalid character in an XML document.

Recommendations For Apache Xerces C++ versions 3.1.3 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

ALT-PU-2016-1794

CVE-2016-2099

DLA-467-1

DSA-3579-1

MGASA-2016-0189

OPENSUSE-SU-2024:10039-1

SUSE-SU-2016:2154-1

SUSE-SU-2016_2154-1

USN-4784-1

Produtos afetados

Alt Linux

Apache Xerces-C

Suse

Ubuntu

Referências · 34

• https://issues.apache.org/jira/browse/XERCESC-2066 · Nota
• https://security.gentoo.org/glsa/201612-46 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-12627 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3579-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2099 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2099 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2016:2154-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10039-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-2099 · Nota
• https://suse.com/security/cve/CVE-2016-4463 · Nota
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Nota
• https://ubuntu.com/security/CVE-2016-4463 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4784-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=18421 · Nota
• https://advisories.mageia.org/MGASA-2016-0189.html · Nota de Segurança