CVE-2016-5300
CVE-2016-5300
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
CVSS 7.5 · High · EPSS 6.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
expat Debian:12
- Affected ranges
- ECOSYSTEM: < 2.1.1-3
Update to 2.1.1-3
expat Debian:13
- Affected ranges
- ECOSYSTEM: < 2.1.1-3
Update to 2.1.1-3
expat Debian:14
- Affected ranges
- ECOSYSTEM: < 2.1.1-3
Update to 2.1.1-3
libxmltok Debian:12
- Versions
- 1.2-4
- 1.2-4.1
- 1.2-4.1~exp1
- 1.2-4.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
expat Ubuntu:14.04:LTS
- Versions
- 2.1.0-4
- 2.1.0-4ubuntu1
- 2.1.0-4ubuntu1.1
- 2.1.0-4ubuntu1.2
- Affected ranges
- ECOSYSTEM: < 2.1.0-4ubuntu1.3
Update to 2.1.0-4ubuntu1.3
vnc4 Ubuntu:Pro:14.04:LTS
- Versions
- 4.1.1+xorg4.3.0-37ubuntu5
- 4.1.1+xorg4.3.0-37ubuntu5.0.1
- 4.1.1+xorg4.3.0-37ubuntu5.0.2
- 4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:Pro:14.04:LTS
- Versions
- 1.16.33-3.2ubuntu3
- 1.33.06-0ubuntu1
- 1.33.06-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
expat Ubuntu:16.04:LTS
- Versions
- 2.1.0-7
- 2.1.0-7ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: < 2.1.0-7ubuntu0.16.04.2
Update to 2.1.0-7ubuntu0.16.04.2
vnc4 Ubuntu:Pro:16.04:LTS
- Versions
- 4.1.1+xorg4.3.0-37.3ubuntu2
- 4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:Pro:16.04:LTS
- Versions
- 1.33.14-0.2ubuntu3
- 1.33.14-1ubuntu1
- 1.33.14-1ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vnc4 Ubuntu:18.04:LTS
- Versions
- 4.1.1+xorg4.3.0-37.3ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:Pro:18.04:LTS
- Versions
- 1.33.14-7
- 1.33.14-8
- 1.33.14-8build1
- 1.33.14-8ubuntu0.18.04.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:Pro:20.04:LTS
- Versions
- 1.33.14-8build1
- 1.33.14-8build2
- 1.33.14-8ubuntu0.20.04.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:Pro:22.04:LTS
- Versions
- 1.33.14-9
- 1.33.14-10
- 1.33.14-10ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:Pro:24.04:LTS
- Versions
- 1.33.14-11
- 1.33.14-11.1
- 1.33.14-12
- 1.33.14-12build1
- 1.33.14-12build2
- 1.33.14-12ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sitecopy Ubuntu:25.10
- Versions
- 1:0.16.6-16
- 1:0.16.6-16build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:25.10
- Versions
- 1.59.03-7
- 1.59.03-9
- 1.59.03-10
- 1.59.03-10.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sitecopy Ubuntu:26.10
- Versions
- 1:0.16.6-16build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:26.10
- Versions
- 1.60.05-1
- 1.60.05-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
sitecopy Ubuntu:26.04:LTS
- Versions
- 1:0.16.6-16build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:26.04:LTS
- Versions
- 1.59.03-10.1
- 1.60.05-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://www.tenable.com/security/tns-2016-20
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.openwall.com/lists/oss-security/2016/06/04/4
- http://www.debian.org/security/2016/dsa-3597
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.securityfocus.com/bid/91159
- https://security.gentoo.org/glsa/201701-21
- https://source.android.com/security/bulletin/2016-11-01.html
- http://www.ubuntu.com/usn/USN-3010-1
- http://www.openwall.com/lists/oss-security/2016/06/04/5
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://nvd.nist.gov/vuln/detail/CVE-2016-5300