The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade expat | Oct 1, 2024 | Jun 30, 2016 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Mar 24, 2017 | Jun 30, 2016 |
| Debian | — | Upgrade expat | Jun 10, 2016 | May 18, 2016 |
| Freebsd | — | Upgrade python27Upgrade expat | Oct 11, 2017 | Jun 30, 2016 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Oct 30, 2017 | Jun 30, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade apr-utilUpgrade apr-util-devel | Jul 23, 2019 | Jun 30, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade expat-develUpgrade expat | Sep 25, 2019 | Jun 30, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade expatUpgrade expat-devel | Jun 27, 2019 | Jun 30, 2016 |
| Ibm Http_server | — | Apply IBM HTTP Server version 9.0.0.2 or laterApply IBM HTTP Server version 8.0.0.13 or laterApply IBM HTTP Server Interim Fix PI73984Apply IBM HTTP Server version 8.5.5.11 or laterApply IBM HTTP Server version 7.0.0.43 or later | Sep 7, 2022 | Sep 7, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 15, 2016 |
| Suse | — | Upgrade python3Upgrade python3-baseUpgrade python3-develUpgrade libexpat1Upgrade expatUpgrade libexpat-develUpgrade libexpat1-32bitUpgrade python3-cursesUpgrade python3-dbmUpgrade libpython3_4m1_0Upgrade libpython3_4m1_0-32bitUpgrade python3-tk | May 20, 2018 | Jun 30, 2016 |
| Ubuntu | — | Upgrade libxmltok1t64Upgrade libxmltok1t64 (Ubuntu Pro)Upgrade libxmltok1 (Ubuntu Pro)Upgrade libxmlrpc-core-c3Upgrade libxmlrpc-c++4 | Jun 20, 2016 | Jun 20, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub