CVE-2016-2099: Use After Free
Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2099?
CVE-2016-2099 is classified as a medium-severity vulnerability due to its potential impact on the security of applications using Apache Xerces C++.
How do I fix CVE-2016-2099?
To mitigate CVE-2016-2099, upgrade Apache Xerces C++ to version 3.1.4 or later where the vulnerability has been addressed.
What causes CVE-2016-2099?
CVE-2016-2099 is caused by a use-after-free flaw in the DTDScanner component of Apache Xerces C++ when processing invalid characters in XML documents.
Who is affected by CVE-2016-2099?
CVE-2016-2099 affects users of Apache Xerces C++ version 3.1.3 and earlier, as well as openSUSE 13.2 installations that utilize the library.
Can CVE-2016-2099 be exploited remotely?
Yes, CVE-2016-2099 can potentially be exploited by context-dependent attackers through specially crafted XML documents.