CVE-2016-4463
High · 7.5CVSS
7.5
EPSS
14.1%
Published
Jul 8, 2016
CISA due date
—
The record
Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | xerces-c | 0 | 3.1.3+debian-2.1 |
| Debian:12 | xerces-c | 0 | 3.1.3+debian-2.1 |
| Debian:13 | xerces-c | 0 | 3.1.3+debian-2.1 |
| Debian:7 | xerces-c | 0 | 3.1.1-3+deb7u4 |
| Debian:8 | xerces-c | 0 | 3.1.1-5.1+deb8u3 |
| Red Hat:enterprise_linux:7::client | xerces-c | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::client | xerces-c-debuginfo | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::client | xerces-c-devel | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::client | xerces-c-doc | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::computenode | xerces-c | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::computenode | xerces-c-debuginfo | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::computenode | xerces-c-devel | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::computenode | xerces-c-doc | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::server | xerces-c | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::server | xerces-c-debuginfo | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::server | xerces-c-devel | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::server | xerces-c-doc | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::workstation | xerces-c | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::workstation | xerces-c-debuginfo | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::workstation | xerces-c-devel | 0 | 0:3.1.1-9.el7 |
| Red Hat:enterprise_linux:7::workstation | xerces-c-doc | 0 | 0:3.1.1-9.el7 |
| Red Hat:rhel_eus:7.4::computenode | xerces-c | 0 | 0:3.1.1-8.el7_4.1 |
| Red Hat:rhel_eus:7.4::computenode | xerces-c-debuginfo | 0 | 0:3.1.1-8.el7_4.1 |
| Red Hat:rhel_eus:7.4::computenode | xerces-c-devel | 0 | 0:3.1.1-8.el7_4.1 |
| Red Hat:rhel_eus:7.4::computenode | xerces-c-doc | 0 | 0:3.1.1-8.el7_4.1 |
| Red Hat:rhel_eus:7.4::server | xerces-c | 0 | 0:3.1.1-8.el7_4.1 |
| Red Hat:rhel_eus:7.4::server | xerces-c-debuginfo | 0 | 0:3.1.1-8.el7_4.1 |
| Red Hat:rhel_eus:7.4::server | xerces-c-devel | 0 | 0:3.1.1-8.el7_4.1 |
| Red Hat:rhel_eus:7.4::server | xerces-c-doc | 0 | 0:3.1.1-8.el7_4.1 |
| Red Hat:rhel_eus:7.5::computenode | xerces-c | 0 | 0:3.1.1-8.el7_5.1 |
| Red Hat:rhel_eus:7.5::computenode | xerces-c-debuginfo | 0 | 0:3.1.1-8.el7_5.1 |
| Red Hat:rhel_eus:7.5::computenode | xerces-c-devel | 0 | 0:3.1.1-8.el7_5.1 |
| Red Hat:rhel_eus:7.5::computenode | xerces-c-doc | 0 | 0:3.1.1-8.el7_5.1 |
| Red Hat:rhel_eus:7.5::server | xerces-c | 0 | 0:3.1.1-8.el7_5.1 |
| Red Hat:rhel_eus:7.5::server | xerces-c-debuginfo | 0 | 0:3.1.1-8.el7_5.1 |
| Red Hat:rhel_eus:7.5::server | xerces-c-devel | 0 | 0:3.1.1-8.el7_5.1 |
| Red Hat:rhel_eus:7.5::server | xerces-c-doc | 0 | 0:3.1.1-8.el7_5.1 |
| SUSE:Linux Enterprise Desktop 12 SP1 | xerces-c | 0 | 3.1.1-12.3 |
| SUSE:Linux Enterprise Server 12 SP1 | xerces-c | 0 | 3.1.1-12.3 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | xerces-c | 0 | 3.1.1-12.3 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | Xerces-c | 0 | 2.8.0-29.17.5.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | xerces-c | 0 | 3.1.1-12.3 |
| Ubuntu:14.04:LTS | xerces-c | 0 | 3.1.1-5.1+deb8u3build0.14.04.1 |
| Ubuntu:18.04:LTS | xerces-c | 0 | 3.2.0+debian-2 |
| Ubuntu:Pro:16.04:LTS | xerces-c | 0 | 3.1.3+debian-1ubuntu0.1~esm1 |
| Ubuntu:Pro:18.04:LTS | xerces-c | 0 | 3.2.0+debian-2ubuntu0.1~esm1 |
| openSUSE:Tumbleweed | xerces-c | 0 | 3.1.4-1.3 |
Related vulnerabilities
- CVE-2023-37536 An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to… Also affects xerces-c
- CVE-2018-1311 The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered… Also affects xerces-c
- CVE-2016-2099 Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3… Also affects xerces-c
- CVE-2015-0252 internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a… Also affects xerces-c
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-119
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-119
- CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-119