CVE-2016-4472MEDIUM
Description
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
References
http://www.securityfocus.com/bid/91528
http://www.ubuntu.com/usn/USN-3013-1
https://bugzilla.redhat.com/show_bug.cgi?id=1344251
https://security.gentoo.org/glsa/201701-21
https://sourceforge.net/p/expat/code_git/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde
Details
Source: MITRE
Published: 2016-06-30
Updated: 2021-01-25
Type: CWE-119
Risk Information
CVSS v2.0
Base Score: 6.8
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3.0
Base Score: 8.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 2.2
Severity: HIGH
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* versions up to 2.1.1 (inclusive)
Configuration 2
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 145061 | IBM HTTP Server 7.0.0.0 <= 7.0.0.41 / 8.0.0.0 < 8.0.0.13 / 8.5.0.0 < 8.5.5.11 / 9.0.0.0 < 9.0.0.2 Multiple Vulnerabilities (548231) | Nessus | Web Servers | high |
| 137481 | EulerOS 2.0 SP2 : apr-util (EulerOS-SA-2020-1639) | Nessus | Huawei Local Security Checks | medium |
| 137461 | EulerOS 2.0 SP2 : xulrunner (EulerOS-SA-2020-1619) | Nessus | Huawei Local Security Checks | high |
| 134106 | SUSE SLED12 / SLES12 Security Update : python3 (SUSE-SU-2020:0497-1) | Nessus | SuSE Local Security Checks | high |
| 129256 | EulerOS 2.0 SP3 : expat (EulerOS-SA-2019-2063) | Nessus | Huawei Local Security Checks | medium |
| 126869 | EulerOS 2.0 SP2 : expat (EulerOS-SA-2019-1742) | Nessus | Huawei Local Security Checks | medium |
| 126540 | EulerOS Virtualization for ARM 64 3.0.2.0 : expat (EulerOS-SA-2019-1698) | Nessus | Huawei Local Security Checks | medium |
| 126293 | EulerOS 2.0 SP5 : expat (EulerOS-SA-2019-1666) | Nessus | Huawei Local Security Checks | medium |
| 109594 | FreeBSD : python 2.7 -- multiple vulnerabilities (8719b935-8bae-41ad-92ba-3c826f651219) | Nessus | FreeBSD Local Security Checks | high |
| 109583 | Slackware 14.0 / 14.1 / 14.2 / current : python (SSA:2018-124-01) | Nessus | Slackware Local Security Checks | high |
| 103796 | FreeBSD : Python 2.7 -- multiple vulnerabilities (9164f51e-ae20-11e7-a633-009c02a2ab30) | Nessus | FreeBSD Local Security Checks | high |
| 103424 | Slackware 14.0 / 14.1 / 14.2 / current : python (SSA:2017-266-02) | Nessus | Slackware Local Security Checks | high |
| 100027 | Apple iTunes < 12.6 Multiple Vulnerabilities (macOS) (credentialed check) | Nessus | MacOS X Local Security Checks | high |
| 100026 | Apple iTunes < 12.6 Multiple Vulnerabilities (uncredentialed check) | Nessus | Peer-To-Peer File Sharing | high |
| 100025 | Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check) | Nessus | Windows | high |
| 96415 | GLSA-201701-21 : Expat: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 96337 | Tenable Passive Vulnerability Scanner 5.x < 5.2.0 Multiple Vulnerabilities (SWEET32) | Nessus | Misc. | critical |
| 96092 | Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : expat (SSA:2016-359-01) | Nessus | Slackware Local Security Checks | high |
| 92229 | Fedora 22 : expat (2016-0fd6ca526a) | Nessus | Fedora Local Security Checks | high |
| 92117 | Fedora 24 : expat (2016-7c6e7a9265) | Nessus | Fedora Local Security Checks | high |
| 92102 | Fedora 23 : expat (2016-60889583ab) | Nessus | Fedora Local Security Checks | high |
| 91913 | FreeBSD : expat2 -- denial of service (ff76f0e0-3f11-11e6-b3c8-14dae9d210b8) | Nessus | FreeBSD Local Security Checks | medium |
| 91729 | Ubuntu 12.04 LTS : xmlrpc-c vulnerabilities (USN-3013-1) | Nessus | Ubuntu Local Security Checks | high |
| 91200 | Debian DSA-3582-1 : expat - security update | Nessus | Debian Local Security Checks | high |