Fluid Attacks Database

Description

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.2	expat	=2.0.1-r0 \|\| =2.0.1-r1 \|\| =2.0.1-r2 \|\| =2.0.1-r3 \|\| =2.0.1-r4 \|\| =2.0.1-r5 \|\| =2.0.1-r6 \|\| =2.1.0-r0 \|\| =2.1.0-r1 \|\| =2.1.1-r0 \|\| =2.1.1-r1 \|\| >=0 <2.2.0-r0	2.2.0-r0
alpine v3.3	expat	=2.0.1-r0 \|\| =2.0.1-r1 \|\| =2.0.1-r2 \|\| =2.0.1-r3 \|\| =2.0.1-r4 \|\| =2.0.1-r5 \|\| =2.0.1-r6 \|\| =2.1.0-r0 \|\| =2.1.0-r1 \|\| =2.1.0-r2 \|\| =2.1.1-r0 \|\| =2.1.1-r1 \|\| >=0 <2.2.0-r0	2.2.0-r0
alpine v3.4	expat	=2.0.1-r0 \|\| =2.0.1-r1 \|\| =2.0.1-r2 \|\| =2.0.1-r3 \|\| =2.0.1-r4 \|\| =2.0.1-r5 \|\| =2.0.1-r6 \|\| =2.1.0-r0 \|\| =2.1.0-r1 \|\| =2.1.0-r2 \|\| =2.1.1-r0 \|\| =2.1.1-r1 \|\| =2.1.1-r2 \|\| >=0 <2.2.0-r0	2.2.0-r0
debian 11	expat	>=0 <2.1.1-3	2.1.1-3
debian 12	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
debian 13	expat	>=0 <2.1.1-3	2.1.1-3
debian 11	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
debian 12	expat	>=0 <2.1.1-3	2.1.1-3
npm	node-expat	>=0 <2.2.0	2.2.0
debian 14	expat	>=0 <2.1.1-3	2.1.1-3

1-10 of 14

Aliases

1. CVE-2016-53002. NVD-2016-53003. OSV-ALPINE-2016-53004. OSV-2016-53005. OSV-DEBIAN-2016-53006. GCVE-2016-53007. SECURITY-CVE-2016-53008. SECURITY-TRACKER-CVE-2016-5300

References

1. http://www.securityfocus.com/bid/91159

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.