CVE-2016-4570: Medium severity Mini-xml Project Mini-xml vulnerability
The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.
Other sources
Two stack exhaustion issues based on uncontrolled recursion were found in mxml. A maliciously crafted xml file can cause the application to crash.
CVE-2016-4570:
Recursion using mxmlDelete at mxml-node.c:217 (reproducer is stack-exhaustion-1.xml)
CVE-2016-4571:
Recursion using mxmlwritenode at mxml-file.c:2739 (reproducer is stack-exhaustion-2.xml)
References (reproducers available):
http://seclists.org/oss-sec/2016/q2/276
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4570?
CVE-2016-4570 has been classified as a denial of service vulnerability due to potential stack exhaustion.
How do I fix CVE-2016-4570?
To fix CVE-2016-4570, you should upgrade to a patched version of mini-xml that addresses this vulnerability.
Which versions of mini-xml are affected by CVE-2016-4570?
CVE-2016-4570 affects mini-xml versions 2.9, 2.7, and possibly earlier versions.
What type of attack does CVE-2016-4570 enable?
CVE-2016-4570 enables remote attackers to perform denial of service attacks through crafted XML files.
Is CVE-2016-4570 specific to any operating system?
While CVE-2016-4570 is associated with mini-xml, it can also affect systems like Debian GNU/Linux 8.0 if they use the vulnerable library.