High · published June 30, 2016
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
| Product | Versions | Fixed in |
|---|---|---|
| libexpat_project/libexpat | ≤ 2.1.1 | — |
| canonical/ubuntu_linux | all versions | — |
| mcafee/policy_auditor | < 6.5.1 | 6.5.1 |
| python/python | ≥ 2.7.0, < 2.7.15 | 2.7.15 |
| python/python | ≥ 3.3.0, < 3.3.7 | 3.3.7 |
| python/python | ≥ 3.4.0, < 3.4.7 | 3.4.7 |
| python/python | ≥ 3.5.0, < 3.5.4 | 3.5.4 |
| python/python | ≥ 3.6.0, < 3.6.2 | 3.6.2 |