Integer overflow in expat - CVE-2016-9063

Vulnerability identifier: #VU7241

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9063

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to an integer overflow when handling malicious XML files. A remote attacker can send manipulated XML content, trick the victim into opening it and cause the application using the Expat library to crash.

Successful exploitation of the vulnerability results in denial of service.

expat
Arch Linux
Debian Linux
Slackware Linux
Fedora
API Gateway
API Manager
BIG-IP DNS
expat

Update to version 2.2.1.

API Gateway - update to August 2022
API Manager - update to August 2022
BIG-IP DNS - update to 17.5.1
expat - addressed in versions 2.2.1-1.fc24, 2.2.1-1.fc25, 2.2.1-1.fc26

• http://python-security.readthedocs.io/vuln/cve-2017-9233_expat_2.2.1.html

• Debian update for expat
• Arch Linux update for expat
• Slackware Linux update for python
• Arch Linux update for lib32-expat
• Slackware Linux update for python
• Multiple vulnerabilities in API Gateway and API Manager
• Fedora 25 update for expat
• Fedora 24 update for expat
• Fedora 26 update for expat
• F5 BIG-IP (DNS) big3d component update for Python