The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade expat | Oct 1, 2024 | Jun 30, 2016 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Mar 24, 2017 | Jun 30, 2016 |
| Debian | — | Upgrade expat | Jun 10, 2016 | May 18, 2016 |
| Freebsd | — | Upgrade expatUpgrade python27 | Oct 11, 2017 | Jun 30, 2016 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Oct 30, 2017 | Jun 30, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade apr-util-develUpgrade apr-util | Jul 23, 2019 | Jun 30, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade expatUpgrade expat-devel | Sep 25, 2019 | Jun 30, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade expat-develUpgrade expat | Jun 27, 2019 | Jun 30, 2016 |
| Ibm Http_server | — | Apply IBM HTTP Server version 9.0.0.2 or laterApply IBM HTTP Server version 8.5.5.11 or laterApply IBM HTTP Server Interim Fix PI73984Apply IBM HTTP Server version 8.0.0.13 or laterApply IBM HTTP Server version 7.0.0.43 or later | Sep 7, 2022 | Sep 7, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 15, 2016 |
| Suse | — | Upgrade python3-baseUpgrade libexpat-develUpgrade libexpat1-32bitUpgrade python3-develUpgrade expatUpgrade libexpat1Upgrade python3Upgrade python3-cursesUpgrade libpython3_4m1_0-32bitUpgrade python3-dbmUpgrade libpython3_4m1_0Upgrade python3-tk | May 20, 2018 | Jun 30, 2016 |
| Ubuntu | — | Upgrade libxmltok1t64Upgrade libxmltok1t64 (Ubuntu Pro)Upgrade libxmltok1 (Ubuntu Pro)Upgrade libxmlrpc-core-c3Upgrade libxmlrpc-c++4 | Jun 20, 2016 | Jun 20, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub