Published: 16/06/2016 Updated: 07/11/2023

CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 694

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent malicious users to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 12.04
debian debian linux 8.0
canonical ubuntu linux 16.04
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04
libexpat project libexpat
google android 5.0.2
google android 6.0.1
google android 6.0
google android 4.4.4
google android 5.1.1

Several security issues were fixed in XML-RPC for C and C++ ...

Several security issues were fixed in Expat ...

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876 ...

Tenable's Passive Vulnerability Scanner (PVS) uses third-party libraries to provide certain standardized functionality Four of these libraries were found to contain vulnerabilities and were fixed upstream Those fixes have been integrated despite there being no known exploitation scenarios related to PVS OpenSSL ssl/statem/statemc read_state_ma ...

CWE-399 http://www.openwall.com/lists/oss-security/2016/06/04/5 http://www.debian.org/security/2016/dsa-3597 http://www.openwall.com/lists/oss-security/2016/06/04/4 http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html https://source.android.com/security/bulletin/2016-11-01.html http://www.securityfocus.com/bid/91159 http://www.ubuntu.com/usn/USN-3010-1 https://security.gentoo.org/glsa/201701-21 https://www.tenable.com/security/tns-2016-20 http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html https://kc.mcafee.com/corporate/index?page=content&id=SB10365 https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://nvd.nist.gov https://usn.ubuntu.com/3013-1/

CVE-2016-5300

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect