Out-of-bounds read during XML parsing in Expat library

Out-of-bounds read during XML parsing in Expat library

Announced

August 2, 2016

Reporter

Gustavo Grieco

Impact

Moderate

Products

Firefox

Fixed in

• Firefox 48

Description

Security researcher Gustavo Grieco reported a potential out-of-bounds read parsing malformed XML data during character conversion. This is due to a bug in the Expat library, which is used in Firefox. This could allow an attacker to read other inaccessible memory.

References

• Heap read out-of-bound and crash in expat 2.1.0 (CVE-2016-0718)