critical
9.8
CWE
119 125
Advisory Published
CVE Published
CVE Published
Updated

CVE-2016-0718: Buffer Overflow

First published: Wed Jan 06 2016(Updated: )

An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
redhat/expat<0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
redhat/expat<0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
debian/expat
2.2.10-2+deb11u5
2.2.10-2+deb11u6
2.5.0-1+deb12u1
2.6.4-1
debian/firefox
135.0-1
debian/firefox-esr
115.14.0esr-1~deb11u1
128.7.0esr-1~deb11u1
128.5.0esr-1~deb12u1
128.7.0esr-1~deb12u1
128.7.0esr-1
Android
Mozilla Firefox<48.0
Apple iOS and macOS>=10.11.0<=10.11.5
SUSE Linux Enterprise Debuginfo=11-sp4
SUSE Studio Onsite=1.3
SUSE Linux Enterprise Server=11-sp4
SUSE Linux Enterprise Software Development Kit=11-sp4
openSUSE=42.1
SUSE Linux Enterprise Desktop with Beagle=12
SUSE Linux Enterprise Desktop with Beagle=12-sp1
SUSE Linux Enterprise Server=12
SUSE Linux Enterprise Server=12-sp1
SUSE Linux Enterprise Software Development Kit=12
SUSE Linux Enterprise Software Development Kit=12-sp1
Ubuntu=12.04
Ubuntu=14.04
Ubuntu=16.04
Debian (libexpat1)<2.2.0
Debian=8.0
openSUSE=13.1
openSUSE=13.2
McAfee Policy Auditor<6.5.1
Python Babel Localedata>=2.7.0<2.7.15
Python Babel Localedata>=3.3.0<3.3.7
Python Babel Localedata>=3.4.0<3.4.7
Python Babel Localedata>=3.5.0<3.5.4
Python Babel Localedata>=3.6.0<3.6.2

Remedy

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2016-0718?

    CVE-2016-0718 has been assigned a moderate severity level due to the potential for a remote attacker to exploit the vulnerability.

  • How do I fix CVE-2016-0718?

    To resolve CVE-2016-0718, upgrade to the patched versions of Expat as specified in vendor advisories, such as Red Hat or Debian.

  • What systems are affected by CVE-2016-0718?

    CVE-2016-0718 affects multiple applications and platforms that utilize the Expat XML parsing library, notably including specific versions of Firefox and several Linux distributions.

  • What are the potential impacts of CVE-2016-0718?

    Exploitation of CVE-2016-0718 may lead to application crashes or arbitrary code execution with the permissions of the user running the application.

  • Is there a workaround for CVE-2016-0718?

    There are no known workarounds for CVE-2016-0718; updating to a secure version is the recommended approach.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203