PSF-2016-6: High severity Expat Expat vulnerability

Q: Which deployments are exposed?

Deployments using Expat are exposed when the compiler and optimization settings remove its overflow protection and the application processes crafted XML supplied remotely.

Q: Does exploitation require credentials or user interaction?

No privileges or user interaction are required. The attack is network-reachable, although the published vector rates attack complexity as high.

Published Jun 30, 2016

Updated

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.

Affected Software

1 affected component

Expat Expat<2.2.0

Event History

Jun 30, 2016

CVE Published

via OSV·05:59 PM

Data Sourced

via OSV·05:59 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed?

Deployments using Expat are exposed when the compiler and optimization settings remove its overflow protection and the application processes crafted XML supplied remotely.

Does exploitation require credentials or user interaction?

No privileges or user interaction are required. The attack is network-reachable, although the published vector rates attack complexity as high.

PSF-2016-6: High severity Expat Expat vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require credentials or user interaction?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require credentials or user interaction?