Headline
CVE-2016-4472: USN-3013-1: XML-RPC for C and C++ vulnerabilities | Ubuntu security notices | Ubuntu
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
20 June 2016
Several security issues were fixed in XML-RPC for C and C++.
Releases
- Ubuntu 12.04
Packages
- xmlrpc-c - Lightweight RPC library based on XML and HTTP
Details
It was discovered that the Expat code in XML-RPC for C and C++ unexpectedly
called srand in certain circumstances. This could reduce the security of
calling applications. (CVE-2012-6702)
It was discovered that the Expat code in XML-RPC for C and C++ incorrectly
handled seeding the random number generator. A remote attacker could
possibly use this issue to cause a denial of service. (CVE-2016-5300)
Gustavo Grieco discovered that the Expat code in XML-RPC for C and C++
incorrectly handled malformed XML data. If a user or application linked
against XML-RPC for C and C++ were tricked into opening a crafted XML file,
an attacker could cause a denial of service, or possibly execute arbitrary
code. (CVE-2016-0718)
It was discovered that the Expat code in XML-RPC for C and C++ incorrectly
handled malformed XML data. If a user or application linked against XML-RPC
for C and C++ were tricked into opening a crafted XML file, an attacker
could cause a denial of service, or possibly execute arbitrary code.
(CVE-2015-1283, CVE-2016-4472)
Related notices
- USN-3010-1: lib64expat1-dev, expat, lib64expat1, libexpat1-udeb, libexpat1-dev, libexpat1
- USN-2726-1: lib64expat1-dev, expat, lib64expat1, libexpat1-udeb, libexpat1-dev, libexpat1
- USN-2677-1: oxideqt-codecs, liboxideqtcore0, oxideqt-codecs-extra, oxideqmlscene, liboxideqt-qmlplugin, liboxideqtquick0, oxide-qt, oxideqt-chromedriver
- USN-3044-1: firefox-locale-fa, firefox-locale-tr, firefox-locale-zu, firefox-locale-zh-hant, firefox-locale-ro, firefox-locale-az, firefox-locale-nl, firefox-locale-bg, firefox-locale-gu, firefox-locale-fr, firefox-locale-sv, firefox-locale-cak, firefox-locale-eo, firefox-locale-ast, firefox-locale-an, firefox-locale-gd, firefox-globalmenu, firefox-locale-hi, firefox-locale-sk, firefox-locale-uk, firefox-locale-af, firefox-locale-hsb, firefox-locale-nb, firefox-locale-te, firefox-locale-et, firefox-locale-ml, firefox-locale-cy, firefox-locale-csb, firefox-locale-ga, firefox-locale-kk, firefox-locale-fy, firefox-locale-bn, firefox-locale-gn, firefox-locale-nso, firefox-locale-be, firefox-locale-sq, firefox-locale-xh, firefox-locale-eu, firefox-locale-hu, firefox-locale-uz, firefox-locale-gl, firefox-locale-mn, firefox-locale-cs, firefox-locale-as, firefox-locale-mai, firefox-locale-ta, firefox-locale-vi, firefox-locale-mk, firefox-locale-lg, firefox-locale-ca, firefox-locale-pt, firefox-locale-es, firefox-locale-oc, firefox-dev, firefox-locale-pl, firefox-locale-el, firefox-locale-kn, firefox-locale-or, firefox-locale-da, firefox-locale-lv, firefox, firefox-locale-id, firefox-locale-ar, firefox-locale-is, firefox-locale-ka, firefox-locale-ko, firefox-locale-ja, firefox-locale-nn, firefox-locale-he, firefox-locale-sr, firefox-locale-sl, firefox-locale-en, firefox-locale-si, firefox-locale-it, firefox-mozsymbols, firefox-locale-th, firefox-locale-pa, firefox-locale-lt, firefox-locale-sw, firefox-locale-zh-hans, firefox-locale-hr, firefox-locale-br, firefox-locale-de, firefox-locale-mr, firefox-testsuite, firefox-locale-fi, firefox-locale-hy, firefox-locale-ku, firefox-locale-ru, firefox-locale-bs, firefox-locale-ms, firefox-locale-km
- USN-2983-1: lib64expat1-dev, expat, lib64expat1, libexpat1-udeb, libexpat1-dev, libexpat1
Related news
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.40 and prior, 5.7.22 and prior and 8.0.11 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.