CVE-2016-4463

Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.

These are all security issues fixed in the libxerces-c-3_1-3.1.4-1.3 package on the GA media of openSUSE Tumbleweed.

xerces-c was updated to fix one security issue.

This security issue was fixed:

• CVE-2016-2099: Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ did not properly handle exceptions raised in the XMLReader class, which allowed context-dependent attackers to have unspecified impact via an invalid character in an XML document (bsc#979208).
• CVE-2016-4463: Apache Xerces-C XML Parser crashed on malformed DTD (bnc#985860).

This update for Xerces-c fixes the following issues:

• CVE-2017-12627: Processing of external DTD paths could have resulted in a null pointer dereference under certain conditions (bsc#1083630).
• CVE-2016-4463: Prevent stack-based buffer overflow that allowed context-dependent attackers to cause a denial of service via a deeply nested DTD (bsc#985860).

It was discovered that Xerces-C++ XML Parser mishandles certain kinds of external DTD references, resulting in a user-after-free. An attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code. This issue affected only Ubuntu 16.04 ESM. (CVE-2016-2099)

It was discovered that Xerces-C++ XML Parser fails to successfully parse a DTD that is too deeply nested. An unauthenticated attacker could use this vulnerability to cause a denial of service. This issue affected only Ubuntu 16.04 ESM. (CVE-2016-4463)

It was discovered that Xerces-C++ mishandles certain kinds of external DTD references, resulting in dereference of a NULL pointer. An attacker could use this vulnerability to cause a denial of service. (CVE-2017-12627)