PT-2016-2301 · Apache+5 · Apache Xerces-C+5

Published 2016-06-29 · Updated 2024-06-15 · CVE-2016-4463

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Xerces-C++ versions prior to 3.1.4

Description The issue is a stack-based buffer overflow that allows context-dependent attackers to cause a denial of service via a deeply nested DTD. This can be exploited by a remote attacker to disrupt service using nested DTD files.

Recommendations For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of deeply nested DTD files to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2016-1794

BDU:2016-01690

CESA-2018_3335

CVE-2016-4463

DLA-535-1

DSA-3610-1

MGASA-2016-0243

OPENSUSE-SU-2024:10039-1

RHSA-2018:3335

RHSA-2018:3506

RHSA-2018:3514

RHSA-2018_3335

SUSE-SU-2016:2154-1

SUSE-SU-2018:3277-1

SUSE-SU-2018_3277-1

USN-4784-1

Affected Products

Alt Linux

Apache Xerces-C

Centos

Red Hat

Suse

Ubuntu

References · 46

• https://osv.dev/vulnerability/DSA-3610-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3277-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4463 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12627 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-4463 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3514 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10039-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4463 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4784-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3506 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0243.html · Security Note
• https://debian.org/security/2016/dsa-3610 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01690 · Security Note
• https://access.redhat.com/errata/RHSA-2018:3335 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2099 · Vendor Advisory