8.1

CVE-2016-4472

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Libexpat Project ≫ Libexpat Version <= 2.1.1
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition -
Mcafee ≫ Policy Auditor Version < 6.5.1
Python ≫ Python Version >= 2.7.0 < 2.7.15
Python ≫ Python Version >= 3.3.0 < 3.3.7
Python ≫ Python Version >= 3.4.0 < 3.4.7
Python ≫ Python Version >= 3.5.0 < 3.5.4
Python ≫ Python Version >= 3.6.0 < 3.6.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 11.95% 0.958
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

https://www.tenable.com/security/tns-2016-20
Third Party Advisory
https://security.gentoo.org/glsa/201701-21
Third Party Advisory
http://www.securityfocus.com/bid/91528
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1344251
Patch
Third Party Advisory
Issue Tracking
https://sourceforge.net/p/expat/code_git/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde
Patch
Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10365
Third Party Advisory
http://www.ubuntu.com/usn/USN-3013-1
Third Party Advisory