CVE-2016-5300: High severity Google Android vulnerability
Last updated 24 July 2024
Other sources
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-5300?
CVE-2016-5300 is a vulnerability in the XML parser in Expat that allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document.
What is the severity of CVE-2016-5300?
The severity of CVE-2016-5300 is high with a CVSS score of 7.5.
How can the XML parser vulnerability in Expat be exploited?
The vulnerability can be exploited by using crafted identifiers in an XML document to cause a denial of service by consuming excessive CPU resources.
Which software versions are affected by CVE-2016-5300?
XMLRPC-C version 1.16.33-3.1ubuntu5.2, Expat version 2.0.1-7.2ubuntu1.4, Expat version 2.1.0-4ubuntu1.3, Expat version 2.1.0-7ubuntu0.15.10.2, Expat version 2.1.0-7ubuntu0.16.04.2, Expat version 2.2.6-2+deb10u4, Expat version 2.2.6-2+deb10u6, Expat version 2.2.10-2+deb11u5, Expat version 2.5.0-1, and Expat version 2.5.0-2 are affected.
How do I fix CVE-2016-5300?
To fix CVE-2016-5300, make sure you have updated to XMLRPC-C version 1.16.33-3.1ubuntu5.2 or later, or Expat version 2.0.1-7.2ubuntu1.4 or later, depending on the affected software.