CVE-2016-0718
Published on: 05/26/2016 12:00:00 AM UTC
Last Modified on: 03/23/2021 11:27:14 PM UTC
Certain versions of Mac Os X from Apple contain the following vulnerability:
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
- CVE-2016-0718 has been assigned by
[email protected] to track the vulnerability - currently rated as - currently rated as CRITICAL severity.
CVSS3 Score: 9.8 - CRITICAL
Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|
---|---|---|---|---|
NETWORK | LOW | NONE | NONE | |
Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
|
UNCHANGED | HIGH | HIGH | HIGH |
CVSS2 Score: 7.5 - HIGH
Access Vector ⓘ |
Access Complexity |
Authentication |
---|---|---|
NETWORK | LOW | NONE |
Confidentiality Impact |
Integrity Impact |
Availability Impact |
PARTIAL | PARTIAL | PARTIAL |
CVE References
Description | Tags ⓘ | Link |
---|---|---|
Out-of-bounds read during XML parsing in Expat library — Mozilla | Third Party Advisory www.mozilla.org text/html |
![]() |
IBM Security Network Protection Buffer Overflow in Expat Library Lets Remote Users Execute Arbitrary Code - SecurityTracker | Third Party Advisory VDB Entry www.securitytracker.com text/html |
![]() |
About the security content of OS X El Capitan v10.11.6 and Security Update 2016-004 - Apple Support | Third Party Advisory support.apple.com text/html |
![]() |
[security-announce] SUSE-SU-2016:1508-1: important: Security update for | Third Party Advisory lists.opensuse.org text/html |
![]() |
Apple macOS/OS X Multiple Flaws Let Remote and Local Users Deny Service, Obtain Potentially Sensitive Information, and Execute Arbitrary Code - SecurityTracker | Third Party Advisory VDB Entry www.securitytracker.com text/html |
![]() |
Debian -- Security Information -- DSA-3582-1 expat | Third Party Advisory www.debian.org Depreciated Link text/html |
![]() |
[security-announce] openSUSE-SU-2016:1964-1: important: Security update | Third Party Advisory lists.opensuse.org text/html |
![]() |
APPLE-SA-2016-07-18-1 OS X El Capitan v10.11.6 and Security Update 2016-004 | Mailing List Third Party Advisory lists.apple.com text/html |
![]() |
[security-announce] openSUSE-SU-2016:1523-1: important: Security update | Third Party Advisory lists.opensuse.org text/html |
![]() |
[security-announce] openSUSE-SU-2016:2026-1: important: Security update | Third Party Advisory lists.opensuse.org text/html |
![]() |
Android Security Bulletin—November 2016 | Android Open Source Project | Third Party Advisory source.android.com text/html |
![]() |
oss-security - CVE-2016-0718: Expat XML Parser Crashes on Malformed Input | Mailing List Third Party Advisory www.openwall.com text/html |
![]() |
1236923 - (CVE-2016-0718) Heap read out-of-bound and crash in expat 2.1.0 | Issue Tracking Third Party Advisory bugzilla.mozilla.org text/html |
![]() |
CPU July 2018 | Patch Third Party Advisory www.oracle.com text/html |
![]() |
Expat: Multiple vulnerabilities (GLSA 201701-21) — Gentoo Security | Third Party Advisory security.gentoo.org text/html |
![]() |
USN-2983-1: Expat vulnerability | Ubuntu | Third Party Advisory www.ubuntu.com text/html |
![]() |
[security-announce] SUSE-SU-2016:1512-1: important: Security update for | Third Party Advisory lists.opensuse.org text/html |
![]() |
Full Disclosure: CVE-2016-9892 - Remote Code Execution as Root via ESET Endpoint Antivirus 6 | Mailing List Third Party Advisory seclists.org text/html |
![]() |
USN-3044-1: Firefox vulnerabilities | Ubuntu | Third Party Advisory www.ubuntu.com text/html |
![]() |
Red Hat Customer Portal | Third Party Advisory access.redhat.com text/html |
![]() |
ESET Endpoint Antivirus 6 Remote Code Execution ≈ Packet Storm | Third Party Advisory VDB Entry packetstormsecurity.com text/html |
![]() |
Tenable Nessus Buffer Overflow in Expat Library Lets Remote Authenticated Users Execute Arbitrary Code - SecurityTracker | Third Party Advisory VDB Entry www.securitytracker.com text/html |
![]() |
Bug 1296102 – CVE-2016-0718 expat: Out-of-bounds heap read on crafted input causing crash | Issue Tracking Third Party Advisory bugzilla.redhat.com text/html |
![]() |
Expat CVE-2016-0718 Buffer Overflow Vulnerability | Third Party Advisory VDB Entry cve.report (archive) text/html |
![]() |
[R2] PVS 5.2.0 Fixes Multiple Third-party Library Vulnerabilities - Security Advisory | Tenable Network Security | Third Party Advisory www.tenable.com text/html |
![]() |
Red Hat Customer Portal | Third Party Advisory web.archive.org text/html Inactive LinkNot Archived |
![]() |
[security-announce] openSUSE-SU-2016:1441-1: important: Security update | Third Party Advisory lists.opensuse.org text/html |
![]() |
Remote execution and privilege escalation vulnerabilities in ESET products for macOS fixed—ESET Knowledgebase | Third Party Advisory support.eset.com text/html |
![]() |
Oracle Solaris Bulletin - July 2016 | Third Party Advisory www.oracle.com text/html |
![]() |
There are currently no QIDs associated with this CVE
Known Affected Configurations (CPE V2.3)
Type | Vendor | Product | Version | Update | Edition | Language |
---|---|---|---|---|---|---|
Operating System | Apple | Mac Os X | All | All | All | All |
Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
Operating System | Debian | Debian Linux | 8.0 | All | All | All |
Operating System | Debian | Debian Linux | 8.0 | All | All | All |
Application | Libexpat Project | Libexpat | All | All | All | All |
Application | Libexpat Project | Libexpat | All | All | All | All |
Application | Mozilla | Firefox | All | All | All | All |
Application | Mozilla | Firefox | All | All | All | All |
Operating System | Opensuse | Leap | 42.1 | All | All | All |
Operating System | Opensuse | Leap | 42.1 | All | All | All |
Operating System | Opensuse | Opensuse | 13.1 | All | All | All |
Operating System | Opensuse | Opensuse | 13.2 | All | All | All |
Operating System | Opensuse | Opensuse | 13.1 | All | All | All |
Operating System | Opensuse | Opensuse | 13.2 | All | All | All |
Application | Suse | Linux Enterprise Debuginfo | 11 | sp4 | All | All |
Application | Suse | Linux Enterprise Debuginfo | 11 | sp4 | All | All |
Operating System | Suse | Linux Enterprise Desktop | 12 | All | All | All |
Operating System | Suse | Linux Enterprise Desktop | 12.0 | sp1 | All | All |
Operating System | Suse | Linux Enterprise Desktop | 12 | All | All | All |
Operating System | Suse | Linux Enterprise Desktop | 12.0 | sp1 | All | All |
Operating System | Suse | Linux Enterprise Server | 11 | sp4 | All | All |
Operating System | Suse | Linux Enterprise Server | 12 | All | All | All |
Operating System | Suse | Linux Enterprise Server | 12.0 | sp1 | All | All |
Operating System | Suse | Linux Enterprise Server | 11 | sp4 | All | All |
Operating System | Suse | Linux Enterprise Server | 12 | All | All | All |
Operating System | Suse | Linux Enterprise Server | 12.0 | sp1 | All | All |
Operating System | Suse | Linux Enterprise Software Development Kit | 11 | sp4 | All | All |
Operating System | Suse | Linux Enterprise Software Development Kit | 12 | All | All | All |
Operating System | Suse | Linux Enterprise Software Development Kit | 12.0 | sp1 | All | All |
Operating System | Suse | Linux Enterprise Software Development Kit | 11 | sp4 | All | All |
Operating System | Suse | Linux Enterprise Software Development Kit | 12 | All | All | All |
Operating System | Suse | Linux Enterprise Software Development Kit | 12.0 | sp1 | All | All |
Application | Suse | Studio Onsite | 1.3 | All | All | All |
Application | Suse | Studio Onsite | 1.3 | All | All | All |
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*:
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*:
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*:
- cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*:
- cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*:
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*:
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*:
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*:
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*:
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*:
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*:
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*:
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*:
- cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*:
- cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_server:12.0:sp1:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_server:12.0:sp1:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*:
- cpe:2.3:a:suse:studio_onsite:1.3:*:*:*:*:*:*:*:
- cpe:2.3:a:suse:studio_onsite:1.3:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE