CVE-2016-0729
CriticalSummary
Multiple buffer overflows in the XML Parser library in Apache Xerces-C before version 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.
Risk Assessment
Attackers may exploit this vulnerability to disrupt system operations or gain unauthorized access to the system by executing malicious code.
Recommendation
It is recommended to update the Apache Xerces-C library to version 3.1.3 or later to mitigate this vulnerability.
Other vulnerabilities in Apache Xerces-C
See all- CVE-2012-0880High
Apache Xerces-C++ allows remote attackers to cause a denial of service (CPU consumption) via a crafted message sent to an XML service that causes hash table collisions.
- CVE-2016-4463High
A stack-based buffer overflow in Apache Xerces-C++ before version 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
- CVE-2016-2099Critical
A use-after-free vulnerability in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
Original NVD description (English source)
Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.