Vulnerabilities > CVE-2016-0729 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
apache
fedoraproject
CWE-119
nessus

Summary

Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.

Vulnerable Configurations

Part Description Count
Application
Apache
1
OS
Fedoraproject
3

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20160310_XERCES_C_ON_SL7_X.NASL
    descriptionIt was discovered that the Xerces-C XML parser did not properly process certain XML input. By providing specially crafted XML data to an application using Xerces-C for XML processing, a remote attacker could exploit this flaw to cause an application crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2016-0729) After installing the update, all applications using Xerces-C must be restarted for the update to take effect.
    last seen2020-03-18
    modified2016-03-11
    plugin id89864
    published2016-03-11
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89864
    titleScientific Linux Security Update : xerces-c on SL7.x x86_64 (20160310)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(89864);
      script_version("2.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/25");
    
      script_cve_id("CVE-2016-0729");
    
      script_name(english:"Scientific Linux Security Update : xerces-c on SL7.x x86_64 (20160310)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered that the Xerces-C XML parser did not properly
    process certain XML input. By providing specially crafted XML data to
    an application using Xerces-C for XML processing, a remote attacker
    could exploit this flaw to cause an application crash or, possibly,
    execute arbitrary code with the privileges of the application.
    (CVE-2016-0729)
    
    After installing the update, all applications using Xerces-C must be
    restarted for the update to take effect."
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1603&L=scientific-linux-errata&F=&S=&P=4521
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?106b0362"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:xerces-c");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:xerces-c-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:xerces-c-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:xerces-c-doc");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/03/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/11");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 7.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"xerces-c-3.1.1-8.el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"xerces-c-debuginfo-3.1.1-8.el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"xerces-c-devel-3.1.1-8.el7_2")) flag++;
    if (rpm_check(release:"SL7", reference:"xerces-c-doc-3.1.1-8.el7_2")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xerces-c / xerces-c-debuginfo / xerces-c-devel / xerces-c-doc");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3493.NASL
    descriptionGustavo Grieco discovered that xerces-c, a validating XML parser library for C++, mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. These flaws could lead to a denial of service in applications using the xerces-c library, or potentially, to the execution of arbitrary code.
    last seen2020-06-01
    modified2020-06-02
    plugin id88976
    published2016-02-26
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88976
    titleDebian DSA-3493-1 : xerces-c - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3493. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(88976);
      script_version("2.4");
      script_cvs_date("Date: 2018/11/10 11:49:37");
    
      script_cve_id("CVE-2016-0729");
      script_xref(name:"DSA", value:"3493");
    
      script_name(english:"Debian DSA-3493-1 : xerces-c - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Gustavo Grieco discovered that xerces-c, a validating XML parser
    library for C++, mishandles certain kinds of malformed input
    documents, resulting in buffer overflows during processing and error
    reporting. These flaws could lead to a denial of service in
    applications using the xerces-c library, or potentially, to the
    execution of arbitrary code."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815907"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/wheezy/xerces-c"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/xerces-c"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2016/dsa-3493"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the xerces-c packages.
    
    For the oldstable distribution (wheezy), this problem has been fixed
    in version 3.1.1-3+deb7u2.
    
    For the stable distribution (jessie), this problem has been fixed in
    version 3.1.1-5.1+deb8u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xerces-c");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/02/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/02/26");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"libxerces-c-dev", reference:"3.1.1-3+deb7u2")) flag++;
    if (deb_check(release:"7.0", prefix:"libxerces-c-doc", reference:"3.1.1-3+deb7u2")) flag++;
    if (deb_check(release:"7.0", prefix:"libxerces-c-samples", reference:"3.1.1-3+deb7u2")) flag++;
    if (deb_check(release:"7.0", prefix:"libxerces-c3.1", reference:"3.1.1-3+deb7u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libxerces-c-dev", reference:"3.1.1-5.1+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libxerces-c-doc", reference:"3.1.1-5.1+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libxerces-c-samples", reference:"3.1.1-5.1+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libxerces-c3.1", reference:"3.1.1-5.1+deb8u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-429.NASL
    descriptionThis update for xerces-c fixes the following security issues : - CVE-2016-0729: Fix for mishandling certain kinds of malformed input documents, resulting in buffer overlows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. (boo#966822) - CVE-2015-0252: Fix for mishandling certain kinds of malformed input documents, resulting in a segmentation fault during a parse operation (boo#920810)
    last seen2020-06-05
    modified2016-04-08
    plugin id90418
    published2016-04-08
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90418
    titleopenSUSE Security Update : xerces-c (openSUSE-2016-429)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2016-429.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90418);
      script_version("2.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-0252", "CVE-2016-0729");
    
      script_name(english:"openSUSE Security Update : xerces-c (openSUSE-2016-429)");
      script_summary(english:"Check for the openSUSE-2016-429 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for xerces-c fixes the following security issues :
    
      - CVE-2016-0729: Fix for mishandling certain kinds of
        malformed input documents, resulting in buffer overlows
        during processing and error reporting. The overflows can
        manifest as a segmentation fault or as memory corruption
        during a parse operation. (boo#966822)
    
      - CVE-2015-0252: Fix for mishandling certain kinds of
        malformed input documents, resulting in a segmentation
        fault during a parse operation (boo#920810)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=920810"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=966822"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected xerces-c packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xerces-c");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xerces-c-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xerces-c-debugsource");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/04/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/08");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.2", reference:"libxerces-c-3_1-3.1.1-13.3.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxerces-c-3_1-debuginfo-3.1.1-13.3.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxerces-c-devel-3.1.1-13.3.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"xerces-c-3.1.1-13.3.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"xerces-c-debuginfo-3.1.1-13.3.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"xerces-c-debugsource-3.1.1-13.3.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libxerces-c-3_1-32bit-3.1.1-13.3.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libxerces-c-3_1-debuginfo-32bit-3.1.1-13.3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxerces-c-3_1 / libxerces-c-3_1-32bit / libxerces-c-3_1-debuginfo / etc");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2016-0430.NASL
    descriptionFrom Red Hat Security Advisory 2016:0430 : Updated xerces-c packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Xerces-C is a validating XML parser written in a portable subset of C++. It was discovered that the Xerces-C XML parser did not properly process certain XML input. By providing specially crafted XML data to an application using Xerces-C for XML processing, a remote attacker could exploit this flaw to cause an application crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2016-0729) Red Hat would like to thank Gustavo Grieco for reporting this issue. All xerces-c users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, all applications using Xerces-C must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id89859
    published2016-03-11
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89859
    titleOracle Linux 7 : xerces-c (ELSA-2016-0430)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2016:0430 and 
    # Oracle Linux Security Advisory ELSA-2016-0430 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(89859);
      script_version("2.8");
      script_cvs_date("Date: 2019/09/27 13:00:36");
    
      script_cve_id("CVE-2016-0729");
      script_xref(name:"RHSA", value:"2016:0430");
    
      script_name(english:"Oracle Linux 7 : xerces-c (ELSA-2016-0430)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2016:0430 :
    
    Updated xerces-c packages that fix one security issue are now
    available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having Important
    security impact. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available from the
    CVE link in the References section.
    
    Xerces-C is a validating XML parser written in a portable subset of
    C++.
    
    It was discovered that the Xerces-C XML parser did not properly
    process certain XML input. By providing specially crafted XML data to
    an application using Xerces-C for XML processing, a remote attacker
    could exploit this flaw to cause an application crash or, possibly,
    execute arbitrary code with the privileges of the application.
    (CVE-2016-0729)
    
    Red Hat would like to thank Gustavo Grieco for reporting this issue.
    
    All xerces-c users are advised to upgrade to these updated packages,
    which contain a backported patch to correct this issue. After
    installing the update, all applications using Xerces-C must be
    restarted for the update to take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2016-March/005853.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected xerces-c packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xerces-c");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xerces-c-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xerces-c-doc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/03/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/11");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 7", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"xerces-c-3.1.1-8.el7_2")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"xerces-c-devel-3.1.1-8.el7_2")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"xerces-c-doc-3.1.1-8.el7_2")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xerces-c / xerces-c-devel / xerces-c-doc");
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201612-46.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201612-46 (Xerces-C++: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Xerces-C++. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to process a specially crafted file, possibly resulting in the remote execution of arbitrary code with the privileges of the process, or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id96126
    published2016-12-27
    reporterThis script is Copyright (C) 2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/96126
    titleGLSA-201612-46 : Xerces-C++: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201612-46.
    #
    # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(96126);
      script_version("$Revision: 3.1 $");
      script_cvs_date("$Date: 2016/12/27 14:30:01 $");
    
      script_cve_id("CVE-2016-0729", "CVE-2016-2099");
      script_xref(name:"GLSA", value:"201612-46");
    
      script_name(english:"GLSA-201612-46 : Xerces-C++: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201612-46
    (Xerces-C++: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in Xerces-C++. Please
          review the CVE identifiers referenced below for details.
      
    Impact :
    
        A remote attacker could entice a user to process a specially crafted
          file, possibly resulting in the remote execution of arbitrary code with
          the privileges of the process, or a Denial of Service condition.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201612-46"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Xerces-C++ users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-libs/xerces-c-3.1.4-r1'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:xerces-c");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/12/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/27");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-libs/xerces-c", unaffected:make_list("ge 3.1.4-r1"), vulnerable:make_list("lt 3.1.4-r1"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Xerces-C++");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-876.NASL
    descriptionThis update for xerces-c fixes the following issues : - CVE-2016-4463 Apache Xerces-C XML Parser Crashes on Malformed DT (boo#985860) - CVE-2016-2099 Exception handling mistake causing use after free (boo#979208)
    last seen2020-06-05
    modified2016-07-18
    plugin id92354
    published2016-07-18
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92354
    titleopenSUSE Security Update : xerces-c (openSUSE-2016-876)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2016-876.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(92354);
      script_version("2.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2016-0729", "CVE-2016-2099", "CVE-2016-4463");
    
      script_name(english:"openSUSE Security Update : xerces-c (openSUSE-2016-876)");
      script_summary(english:"Check for the openSUSE-2016-876 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for xerces-c fixes the following issues :
    
      - CVE-2016-4463 Apache Xerces-C XML Parser Crashes on
        Malformed DT (boo#985860) 
    
      - CVE-2016-2099 Exception handling mistake causing use
        after free (boo#979208)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=979208"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=985860"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected xerces-c packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xerces-c");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xerces-c-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xerces-c-debugsource");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/07/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/18");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.2", reference:"libxerces-c-3_1-3.1.4-13.9.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxerces-c-3_1-debuginfo-3.1.4-13.9.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxerces-c-devel-3.1.4-13.9.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"xerces-c-3.1.4-13.9.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"xerces-c-debuginfo-3.1.4-13.9.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"xerces-c-debugsource-3.1.4-13.9.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libxerces-c-3_1-32bit-3.1.4-13.9.2") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libxerces-c-3_1-debuginfo-32bit-3.1.4-13.9.2") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxerces-c-3_1 / libxerces-c-3_1-32bit / libxerces-c-3_1-debuginfo / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-499.NASL
    descriptionThis update for xerces-c fixes the following security issue : - CVE-2016-0729: Fixed mishandling certain kinds of malformed input documents, that resulted in buffer overlows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. (bsc#966822) This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-05
    modified2016-04-22
    plugin id90665
    published2016-04-22
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/90665
    titleopenSUSE Security Update : xerces-c (openSUSE-2016-499)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2016-499.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90665);
      script_version("2.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2016-0729");
    
      script_name(english:"openSUSE Security Update : xerces-c (openSUSE-2016-499)");
      script_summary(english:"Check for the openSUSE-2016-499 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for xerces-c fixes the following security issue :
    
      - CVE-2016-0729: Fixed mishandling certain kinds of
        malformed input documents, that resulted in buffer
        overlows during processing and error reporting. The
        overflows can manifest as a segmentation fault or as
        memory corruption during a parse operation. (bsc#966822)
    
    This update was imported from the SUSE:SLE-12:Update update project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=966822"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected xerces-c packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-3_1-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxerces-c-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xerces-c");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xerces-c-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:xerces-c-debugsource");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/04/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/22");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE42.1", reference:"libxerces-c-3_1-3.1.1-16.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libxerces-c-3_1-debuginfo-3.1.1-16.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libxerces-c-devel-3.1.1-16.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"xerces-c-3.1.1-16.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"xerces-c-debuginfo-3.1.1-16.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"xerces-c-debugsource-3.1.1-16.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libxerces-c-3_1-32bit-3.1.1-16.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libxerces-c-3_1-debuginfo-32bit-3.1.1-16.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxerces-c-3_1 / libxerces-c-3_1-32bit / libxerces-c-3_1-debuginfo / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-0430.NASL
    descriptionUpdated xerces-c packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Xerces-C is a validating XML parser written in a portable subset of C++. It was discovered that the Xerces-C XML parser did not properly process certain XML input. By providing specially crafted XML data to an application using Xerces-C for XML processing, a remote attacker could exploit this flaw to cause an application crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2016-0729) Red Hat would like to thank Gustavo Grieco for reporting this issue. All xerces-c users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, all applications using Xerces-C must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id89862
    published2016-03-11
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89862
    titleRHEL 7 : xerces-c (RHSA-2016:0430)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2016:0430. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(89862);
      script_version("2.14");
      script_cvs_date("Date: 2019/10/24 15:35:41");
    
      script_cve_id("CVE-2016-0729");
      script_xref(name:"RHSA", value:"2016:0430");
    
      script_name(english:"RHEL 7 : xerces-c (RHSA-2016:0430)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated xerces-c packages that fix one security issue are now
    available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having Important
    security impact. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available from the
    CVE link in the References section.
    
    Xerces-C is a validating XML parser written in a portable subset of
    C++.
    
    It was discovered that the Xerces-C XML parser did not properly
    process certain XML input. By providing specially crafted XML data to
    an application using Xerces-C for XML processing, a remote attacker
    could exploit this flaw to cause an application crash or, possibly,
    execute arbitrary code with the privileges of the application.
    (CVE-2016-0729)
    
    Red Hat would like to thank Gustavo Grieco for reporting this issue.
    
    All xerces-c users are advised to upgrade to these updated packages,
    which contain a backported patch to correct this issue. After
    installing the update, all applications using Xerces-C must be
    restarted for the update to take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2016:0430"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-0729"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xerces-c");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xerces-c-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xerces-c-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xerces-c-doc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/03/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/11");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2016:0430";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL7", reference:"xerces-c-3.1.1-8.el7_2")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"xerces-c-debuginfo-3.1.1-8.el7_2")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"xerces-c-devel-3.1.1-8.el7_2")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"xerces-c-doc-3.1.1-8.el7_2")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xerces-c / xerces-c-debuginfo / xerces-c-devel / xerces-c-doc");
      }
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-9FF972CA42.NASL
    descriptionUpdate to xerces-c 3.1.3, fixing CVE-2016-0729 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-04-13
    plugin id90466
    published2016-04-13
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/90466
    titleFedora 24 : xerces-c-3.1.3-1.fc24 (2016-9ff972ca42)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2016-9ff972ca42.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90466);
      script_version("2.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2016-0729");
      script_xref(name:"FEDORA", value:"2016-9ff972ca42");
    
      script_name(english:"Fedora 24 : xerces-c-3.1.3-1.fc24 (2016-9ff972ca42)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Update to xerces-c 3.1.3, fixing CVE-2016-0729
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1312231"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2016-April/182062.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b3c2d194"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected xerces-c package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:xerces-c");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:24");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/04/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^24([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 24.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC24", reference:"xerces-c-3.1.3-1.fc24")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xerces-c");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1026-1.NASL
    descriptionThis update for xerces-c fixes the following security issue : - CVE-2016-0729: Fixed mishandling certain kinds of malformed input documents, that resulted in buffer overlows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. (bsc#966822) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id90535
    published2016-04-15
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90535
    titleSUSE SLED12 / SLES12 Security Update : xerces-c (SUSE-SU-2016:1026-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-433.NASL
    descriptionGustavo Grieco discovered that xerces-c, a validating XML parser library for C++, mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. These flaws could lead to a denial of service in applications using the xerces-c library, or potentially, to the execution of arbitrary code. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2016-02-26
    plugin id88974
    published2016-02-26
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88974
    titleDebian DLA-433-1 : xerces-c security update
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2016-1004.NASL
    descriptionAccording to the version of the xerces-c package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered that the Xerces-C XML parser did not properly process certain XML input. By providing specially crafted XML data to an application using Xerces-C for XML processing, a remote attacker could exploit this flaw to cause an application crash or, possibly, execute arbitrary code with the privileges of the application.(CVE-2016-0729) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99767
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99767
    titleEulerOS 2.0 SP1 : xerces-c (EulerOS-SA-2016-1004)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-880B91C090.NASL
    descriptionUpdate to xerces-c 3.1.3, fixing CVE-2016-0729 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-04-22
    plugin id90654
    published2016-04-22
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/90654
    titleFedora 22 : xerces-c-3.1.3-1.fc22 (2016-880b91c090)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-87E8468465.NASL
    descriptionMinGW cross compiled xerces-c 3.1.4, fixing CVE-2016-0729, CVE-2016-2099 and CVE-2016-4463 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-07-15
    plugin id92263
    published2016-07-15
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92263
    titleFedora 23 : mingw-xerces-c (2016-87e8468465)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-AE9AC16CF3.NASL
    descriptionUpdate to xerces-c 3.1.3, fixing CVE-2016-0729 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-04-14
    plugin id90518
    published2016-04-14
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/90518
    titleFedora 23 : xerces-c-3.1.3-1.fc23 (2016-ae9ac16cf3)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2016-0430.NASL
    descriptionUpdated xerces-c packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Xerces-C is a validating XML parser written in a portable subset of C++. It was discovered that the Xerces-C XML parser did not properly process certain XML input. By providing specially crafted XML data to an application using Xerces-C for XML processing, a remote attacker could exploit this flaw to cause an application crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2016-0729) Red Hat would like to thank Gustavo Grieco for reporting this issue. All xerces-c users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, all applications using Xerces-C must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id89850
    published2016-03-11
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89850
    titleCentOS 7 : xerces-c (CESA-2016:0430)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_A7F2E9C6DE2011E584586CC21735F730.NASL
    descriptionThe Apache Software Foundation reports : The Xerces-C XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id89015
    published2016-02-29
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89015
    titleFreeBSD : xerces-c3 -- Parser Crashes on Malformed Input (a7f2e9c6-de20-11e5-8458-6cc21735f730)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-7615FEBBD6.NASL
    descriptionMinGW cross compiled xerces-c 3.1.4, fixing CVE-2016-0729, CVE-2016-2099 and CVE-2016-4463 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-07-15
    plugin id92257
    published2016-07-15
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92257
    titleFedora 22 : mingw-xerces-c (2016-7615febbd6)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-0A061F6DD9.NASL
    descriptionMinGW cross compiled xerces-c 3.1.4, fixing CVE-2016-0729, CVE-2016-2099 and CVE-2016-4463 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-07-15
    plugin id92226
    published2016-07-15
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92226
    titleFedora 24 : mingw-xerces-c (2016-0a061f6dd9)

Redhat

advisories
bugzilla
id1312231
titleCVE-2016-0729 xerces-c: parser crashes on malformed input
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • commentxerces-c-doc is earlier than 0:3.1.1-8.el7_2
          ovaloval:com.redhat.rhsa:tst:20160430001
        • commentxerces-c-doc is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20151193004
      • AND
        • commentxerces-c-devel is earlier than 0:3.1.1-8.el7_2
          ovaloval:com.redhat.rhsa:tst:20160430003
        • commentxerces-c-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20151193002
      • AND
        • commentxerces-c is earlier than 0:3.1.1-8.el7_2
          ovaloval:com.redhat.rhsa:tst:20160430005
        • commentxerces-c is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20151193006
rhsa
idRHSA-2016:0430
released2016-03-10
severityImportant
titleRHSA-2016:0430: xerces-c security update (Important)
rpms
  • xerces-c-0:3.1.1-8.el7_2
  • xerces-c-debuginfo-0:3.1.1-8.el7_2
  • xerces-c-devel-0:3.1.1-8.el7_2
  • xerces-c-doc-0:3.1.1-8.el7_2