CVE-2016-4463: Buffer Overflow
Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
Other sources
The Xerces-C XML parser fails to successfully parse a DTD that is deeply nested, and this causes a stack overflow, which makes a denial of service attack against many applications possible by an unauthenticated attacker.
Upstream patch:
http://svn.apache.org/viewvc?view=revision&revision=1747619
Upstream bugs:
https://issues.apache.org/jira/browse/XERCESC-2066 https://issues.apache.org/jira/browse/XERCESC-2069
In addition, a related enhancement was made to enable applications to fully disable DTD processing through the use of an environment variable.
http://svn.apache.org/viewvc?view=revision&revision=1747620
External References:
http://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4463?
CVE-2016-4463 has been classified as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2016-4463?
To fix CVE-2016-4463, upgrade Apache Xerces-C++ to version 3.1.4 or later.
Who is affected by CVE-2016-4463?
CVE-2016-4463 affects versions of Apache Xerces-C++ prior to 3.1.4 that are utilized in applications handling XML DTDs.
What type of vulnerability is CVE-2016-4463?
CVE-2016-4463 is a stack-based buffer overflow vulnerability.
What are the consequences of exploiting CVE-2016-4463?
Exploiting CVE-2016-4463 can lead to a denial of service, causing applications to crash when processing deeply nested DTDs.