CVE-2016-2099

NameCVE-2016-2099
DescriptionUse-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-467-1, DSA-3579-1
NVD severityhigh (attack range: remote)
Debian Bugs823863

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xerces-c (PTS)wheezy3.1.1-3+deb7u2vulnerable
wheezy (security)3.1.1-3+deb7u4fixed
jessie (security), jessie3.1.1-5.1+deb8u3fixed
buster, sid, stretch3.1.4+debian-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xerces-csource(unstable)3.1.3+debian-2high823863
xerces-csourcejessie3.1.1-5.1+deb8u2highDSA-3579-1
xerces-csourcewheezy3.1.1-3+deb7u3highDLA-467-1

Notes

https://issues.apache.org/jira/browse/XERCESC-2066

Search for package or bug name: Reporting problems