PT-2016-4390 · Apache+3 · Apache Xerces-C+3

Gustavo Grieco · Published 2016-02-25 · Updated 2024-06-15 · CVE-2016-0729

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Xerces-C versions prior to 3.1.3

Description The issue is related to multiple buffer overflows in the XML Parser library, specifically in the internal/XMLReader.cpp, util/XMLURL.cpp, and util/XMLUri.cpp files. This can be exploited by remote attackers using a crafted document, potentially leading to a denial of service, such as a segmentation fault or memory corruption, or possibly allowing the execution of arbitrary code.

Recommendations For Apache Xerces-C versions prior to 3.1.3, update to version 3.1.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XML Parser library until a patch is applied. Avoid processing crafted documents from untrusted sources to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2016_0430

CVE-2016-0729

DLA-433-1

DSA-3493-1

MGASA-2016-0088

OPENSUSE-SU-2024:10039-1

RHSA-2016:0430

RHSA-2016_0430

SUSE-SU-2016:1026-1

SUSE-SU-2016_1026-1

Affected Products

Apache Xerces-C

Centos

Red Hat

Suse

References · 38

• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182597.html · Vendor Advisory
• https://issues.apache.org/jira/browse/XERCESC-2061 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-0729 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-0729 · Vendor Advisory
• https://security.gentoo.org/glsa/201612-46 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00086.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-0729 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10039-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-0729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0729 · Security Note
• http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt · Vendor Advisory
• http://debian.org/security/2016/dsa-3493 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0088.html · Security Note
• https://osv.dev/vulnerability/DSA-3493-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-0729 · Security Note