Memory corruption in Sametime - CVE-2016-0729

Vulnerability identifier: #VU8015

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-0729

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists in the Apache Xerces-C XML Parser library due to improper bounds checking during processing and error reporting. A remote attacker can send a specially crafted input documents and cause the library to crash or possibly execute arbitrary code.

Successful exploitation of the vulnerability results in denial of service.

Sametime
Debian Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Fedora
PeopleSoft Enterprise PeopleTools
xerces-c

Update to version 9.0.1 FP1.

xerces-c - addressed in versions 3.1.3-1.fc22, 3.1.3-1.fc23, 3.1.3-1.fc24

• http://www-01.ibm.com/support/docview.wss?uid=swg22006233

• Multiple vulnerabilities in IBM Sametime
• Debian update for xerces-c
• Red Hat update for xerces-c
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Fedora 23 update for xerces-c
• Fedora 22 update for xerces-c
• Fedora 24 update for xerces-c