CVE-2016-2099

NameCVE-2016-2099
DescriptionUse-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-467-1, DSA-3579-1
Debian Bugs823863

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xerces-c (PTS)buster3.2.2+debian-1+deb10u1fixed
buster (security)3.2.2+debian-1+deb10u2fixed
bullseye3.2.3+debian-3+deb11u1fixed
bookworm3.2.4+debian-1fixed
trixie3.2.4+debian-1.1fixed
sid3.2.4+debian-1.3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xerces-csourcewheezy3.1.1-3+deb7u3DLA-467-1
xerces-csourcejessie3.1.1-5.1+deb8u2DSA-3579-1
xerces-csource(unstable)3.1.3+debian-2823863

Notes

https://issues.apache.org/jira/browse/XERCESC-2066
Search for package or bug name: Reporting problems