CVE-2016-2099

Published: May 13, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.

Affected (2)

Products: Apache: Xerces C++ · Opensuse: Opensuse

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Xerces C++	Up to 3.1.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.2

References (18)

http://lists.opensuse.org/opensuse-updates/2016-07/msg00016.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2016-07/msg00053.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2016-09/msg00013.html

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3579

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/05/09/7

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/90502

Source: secalert@redhat.com

https://issues.apache.org/jira/browse/XERCESC-2066

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201612-46

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2016-07/msg00016.html