CVE-2016-0718: Buffer Overflow

Published Jan 6, 2016
·
Updated

An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.

Other sources

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution.

Red Hat

Affected Software

32 affected componentsFixes available
redhat/expat<0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
redhat/expat<0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
Google Android
Mozilla Firefox<48.0
Apple iOS and macOS>=10.11.0<=10.11.5
SUSE Linux Enterprise Debuginfo=11-sp4
SUSE Studio onsite=1.3
SUSE Linux Enterprise Server=11-sp4
SUSE Linux Enterprise Software Development Kit=11-sp4
openSUSE Leap=42.1
SUSE Linux Enterprise Desktop=12
SUSE Linux Enterprise Desktop=12-sp1
SUSE Linux Enterprise Server=12
SUSE Linux Enterprise Server=12-sp1
SUSE Linux Enterprise Software Development Kit=12
SUSE Linux Enterprise Software Development Kit=12-sp1
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Libexpat Project Libexpat<2.2.0
Debian Debian Linux=8.0
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
McAfee Policy Auditor<6.5.1
Python Python>=2.7.0<2.7.15
Python Python>=3.3.0<3.3.7
Python Python>=3.4.0<3.4.7
Python Python>=3.5.0<3.5.4
Python Python>=3.6.0<3.6.2
debian/expat
2.2.10-2+deb11u52.2.10-2+deb11u72.5.0-1+deb12u12.7.1-1
debian/firefox
138.0.1-1
debian/firefox-esr
115.14.0esr-1~deb11u1128.9.0esr-1~deb11u1128.8.0esr-1~deb12u1128.10.0esr-1~deb12u1128.9.0esr-2128.10.0esr-1

Event History

Jan 6, 2016
Data Sourced
via Red Hat·10:35 AM
DescriptionSeverityAffected Software
May 17, 2016
CVE Published
12:00 AM
May 26, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Nov 7, 2016
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:13 PM
Description
Jan 18, 2025
Data Sourced
via Ubuntu·01:38 AM
RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2016-0718?

CVE-2016-0718 has been assigned a moderate severity level due to the potential for a remote attacker to exploit the vulnerability.

2

How do I fix CVE-2016-0718?

To resolve CVE-2016-0718, upgrade to the patched versions of Expat as specified in vendor advisories, such as Red Hat or Debian.

3

What systems are affected by CVE-2016-0718?

CVE-2016-0718 affects multiple applications and platforms that utilize the Expat XML parsing library, notably including specific versions of Firefox and several Linux distributions.

4

What are the potential impacts of CVE-2016-0718?

Exploitation of CVE-2016-0718 may lead to application crashes or arbitrary code execution with the permissions of the user running the application.

5

Is there a workaround for CVE-2016-0718?

There are no known workarounds for CVE-2016-0718; updating to a secure version is the recommended approach.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203