K04253390 : Apache Xerces vulnerability CVE-2016-2099

Security Advisory Description

Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier does not properly handle exceptions raised in the XMLReader class, which allows context-dependent attackers to have unspecified impact via an invalid character in an XML document. (CVE-2016-2099)
Impact

• An attacker requires privileged access to a dynamically generated XML file to exploit one of the affected components of the BIG-IP APM system. Additionally, an attacker must have access to a privileged user in order to download a malformed XML file on the system to trigger the exploit.
• The XML file accessed by the affected component of BIG-IP Analytics is internal and inaccessible to external sources, thus limiting the vulnerability exposure.