PT-2016-5016 · Apache+3 · Apache Xerces-C+3

Gustavo Grieco · Published 2016-05-13 · Updated 2024-06-15 · CVE-2016-2099

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Xerces C++ versions 3.1.3 and earlier

Description A use-after-free issue exists in the validators/DTD/DTDScanner.cpp component, allowing context-dependent attackers to have an unspecified impact by including an invalid character in an XML document.

Recommendations For Apache Xerces C++ versions 3.1.3 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

ALT-PU-2016-1794

CVE-2016-2099

DLA-467-1

DSA-3579-1

MGASA-2016-0189

OPENSUSE-SU-2024:10039-1

SUSE-SU-2016:2154-1

SUSE-SU-2016_2154-1

USN-4784-1

Affected Products

Alt Linux

Apache Xerces-C

Suse

Ubuntu

References · 34

• https://security.gentoo.org/glsa/201612-46 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12627 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3579-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2099 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2099 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2154-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10039-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4463 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4784-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0189.html · Security Note
• https://cve.org/CVERecord?id=CVE-2016-2099 · Security Note
• http://debian.org/security/2016/dsa-3579 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2099 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2099 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2099 · Vendor Advisory