CVE-2016-2099
CriticalSummary
A use-after-free vulnerability in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
Risk Assessment
Attackers may exploit this vulnerability to inject malicious code or disrupt the operation of applications processing XML documents, potentially leading to data loss or system integrity breaches.
Recommendation
It is recommended to upgrade to the latest version of Apache Xerces C++ to mitigate this vulnerability and to conduct a security audit of applications processing XML.
Other vulnerabilities in Apache Xerces C++
See all- CVE-2012-0880High
Apache Xerces-C++ allows remote attackers to cause a denial of service (CPU consumption) via a crafted message sent to an XML service that causes hash table collisions.
- CVE-2016-4463High
A stack-based buffer overflow in Apache Xerces-C++ before version 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
- CVE-2016-0729Critical
Multiple buffer overflows in the XML Parser library in Apache Xerces-C before version 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.
Original NVD description (English source)
Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.