CVE-2016-4463

🗓️ 08 Jul 2016 19:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 115 Views

Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD

Reporter	Title	Published	Views	Family All 106
IBM Security Bulletins	Security Bulletin: A vulnerability in the Apache Xerces-C XML Parser library affects IBM Performance Management products (CVE-2016-4463)	17 Jun 201815:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Streams is affected by Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-4463)	16 Jun 201813:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Common Reporting (TCR) 2017Q3 Security Updater: TCR, a part of IBM Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities	17 Jun 201815:47	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilty in XMLC affects IBM® DB2® LUW (CVE-2016-0729, CVE-2016-4463)	16 Jun 201813:41	–	ibm
IBM Security Bulletins	Security Bulletin: XML vulnerabilities in ClearQuest (CVE-2016-0729, CVE-2016-4463)	4 Feb 202016:40	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Xerces-C XML Parser library affects IBM Tivoli Composite Application Manager for Transactions (CVE-2016-4463)	17 Jun 201815:32	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in the Apache Xerces-C XML Parser affects IBM Cognos Metrics Manager.	15 Jun 201823:48	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Apache Xerces-C XML parser vulnerabilities affect IBM Integration Bus and WebSphere Message Broker (CVE-2016-4463, CVE-2016-0729)	23 Mar 202020:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Forms Server may be affected by an Apache Xerces-C XML Parser library vulnerability (CVE-2016-0729, CVE-2016-4463)	16 Jun 201820:03	–	ibm
IBM Security Bulletins	Security Bulletin: An XML parser vulnerability affects IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web 7.0 software releases (CVE-2016-4463)	16 Jun 201821:49	–	ibm

NVD

Node

apache xerces-c++Range≤3.1.3

Node

debian debian_linuxMatch8.0

Source	Link
oracle	www.oracle.com/security-alerts/cpuapr2020.html
access	www.access.redhat.com/errata/RHSA-2018:3506
securityfocus	www.securityfocus.com/bid/91501
issues	www.issues.apache.org/jira/secure/ReleaseNote.jspa
securitytracker	www.securitytracker.com/id/1036211
access	www.access.redhat.com/errata/RHSA-2018:3335
lists	www.lists.opensuse.org/opensuse-updates/2016-09/msg00013.html
issues	www.issues.apache.org/jira/browse/XERCESC-2069
securityfocus	www.securityfocus.com/archive/1/538784/100/0/threaded
access	www.access.redhat.com/errata/RHSA-2018:3514

06 May 2026 22:30Current

7.7High risk

Vulners AI Score7.7

CVSS 25

CVSS 37.5

EPSS0.38346

CWE-119

cve-2016-4463 apache xerces-c++buffer overflow denial of service dtd