[SECURITY] [DLA 467-1] xerces-c security update

2016-05-1211:59:55

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

72.4%

JSON

Package : xerces-c
Version : 3.1.1-3+deb7u3
CVE ID : CVE-2016-2099
Debian Bug : 823863

XMLReader class can raise an exception if an invalid character is
encountered, and the exception crosses stack frames in an unsafe way that
causes a higher level exception handler to access an already-freed object.

OSVersionArchitecturePackageVersionFilename
Debian8amd64libxerces-c3.1< 3.1.1-5.1+deb8u2libxerces-c3.1_3.1.1-5.1+deb8u2_amd64.deb
Debian7armhflibxerces-c-dev< 3.1.1-3+deb7u3libxerces-c-dev_3.1.1-3+deb7u3_armhf.deb
Debian8allxerces-c< 3.1.1-5.1+deb8u2xerces-c_3.1.1-5.1+deb8u2_all.deb
Debian8armhflibxerces-c-dev< 3.1.1-5.1+deb8u2libxerces-c-dev_3.1.1-5.1+deb8u2_armhf.deb
Debian7amd64libxerces-c3.1< 3.1.1-3+deb7u3libxerces-c3.1_3.1.1-3+deb7u3_amd64.deb
Debian8s390xlibxerces-c3.1< 3.1.1-5.1+deb8u2libxerces-c3.1_3.1.1-5.1+deb8u2_s390x.deb
Debian8amd64libxerces-c-samples< 3.1.1-5.1+deb8u2libxerces-c-samples_3.1.1-5.1+deb8u2_amd64.deb
Debian8powerpclibxerces-c3.1< 3.1.1-5.1+deb8u2libxerces-c3.1_3.1.1-5.1+deb8u2_powerpc.deb
Debian8i386libxerces-c3.1< 3.1.1-5.1+deb8u2libxerces-c3.1_3.1.1-5.1+deb8u2_i386.deb
Debian8arm64libxerces-c-samples< 3.1.1-5.1+deb8u2libxerces-c-samples_3.1.1-5.1+deb8u2_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	libxerces-c3.1	< 3.1.1-5.1+deb8u2	libxerces-c3.1_3.1.1-5.1+deb8u2_amd64.deb
Debian	7	armhf	libxerces-c-dev	< 3.1.1-3+deb7u3	libxerces-c-dev_3.1.1-3+deb7u3_armhf.deb
Debian	8	all	xerces-c	< 3.1.1-5.1+deb8u2	xerces-c_3.1.1-5.1+deb8u2_all.deb
Debian	8	armhf	libxerces-c-dev	< 3.1.1-5.1+deb8u2	libxerces-c-dev_3.1.1-5.1+deb8u2_armhf.deb
Debian	7	amd64	libxerces-c3.1	< 3.1.1-3+deb7u3	libxerces-c3.1_3.1.1-3+deb7u3_amd64.deb
Debian	8	s390x	libxerces-c3.1	< 3.1.1-5.1+deb8u2	libxerces-c3.1_3.1.1-5.1+deb8u2_s390x.deb
Debian	8	amd64	libxerces-c-samples	< 3.1.1-5.1+deb8u2	libxerces-c-samples_3.1.1-5.1+deb8u2_amd64.deb
Debian	8	powerpc	libxerces-c3.1	< 3.1.1-5.1+deb8u2	libxerces-c3.1_3.1.1-5.1+deb8u2_powerpc.deb
Debian	8	i386	libxerces-c3.1	< 3.1.1-5.1+deb8u2	libxerces-c3.1_3.1.1-5.1+deb8u2_i386.deb
Debian	8	arm64	libxerces-c-samples	< 3.1.1-5.1+deb8u2	libxerces-c-samples_3.1.1-5.1+deb8u2_arm64.deb