{"id":"CVE-2016-0718","state":"PUBLISHED","title":"Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.","description":"Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.","publishedAt":"2016-05-26T16:00:00.000Z","updatedAt":"2026-10-08T21:03:22.211Z","severity":null,"assigner":"redhat","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["http://rhn.redhat.com/errata/RHSA-2016-2824.html","https://www.tenable.com/security/tns-2016-20","http://www.securitytracker.com/id/1037705","http://www.securitytracker.com/id/1036415","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.ubuntu.com/usn/USN-2983-1","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html","http://support.eset.com/ca6333/","http://www.securityfocus.com/bid/90729","http://www.ubuntu.com/usn/USN-3044-1","http://www.openwall.com/lists/oss-security/2016/05/17/12","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html","https://bugzilla.mozilla.org/show_bug.cgi?id=1236923","http://seclists.org/fulldisclosure/2017/Feb/68","https://security.gentoo.org/glsa/201701-21","https://source.android.com/security/bulletin/2016-11-01.html","http://www.debian.org/security/2016/dsa-3582","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html","https://bugzilla.redhat.com/show_bug.cgi?id=1296102","http://www.mozilla.org/security/announce/2016/mfsa2016-68.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html","https://access.redhat.com/errata/RHSA-2018:2486","http://www.securitytracker.com/id/1036348","https://support.apple.com/HT206903","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html","http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365"],"weaknesses":[],"ingestedAt":"2026-10-29T19:42:22.336Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2016/0xxx/CVE-2016-0718.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2016-0718","state":"PUBLISHED","datePublished":"2016-05-26T16:00:00.000Z","dateUpdated":"2026-10-08T21:03:22.211Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2015-12-16T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2824.html","name":"RHSA-2016:2824","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.tenable.com/security/tns-2016-20","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1037705","name":"1037705","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.securitytracker.com/id/1036415","name":"1036415","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.ubuntu.com/usn/USN-2983-1","name":"USN-2983-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html","name":"openSUSE-SU-2016:1523","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://support.eset.com/ca6333/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/90729","name":"90729","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.ubuntu.com/usn/USN-3044-1","name":"USN-3044-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/17/12","name":"[oss-security] 20160517 CVE-2016-0718: Expat XML Parser Crashes on Malformed Input","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","name":"APPLE-SA-2016-07-18-1","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html","name":"SUSE-SU-2016:1508","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1236923","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/fulldisclosure/2017/Feb/68","name":"20170227 CVE-2016-9892 - Remote Code Execution as Root via ESET Endpoint Antivirus 6","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://security.gentoo.org/glsa/201701-21","name":"GLSA-201701-21","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://source.android.com/security/bulletin/2016-11-01.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.debian.org/security/2016/dsa-3582","name":"DSA-3582","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html","name":"SUSE-SU-2016:1512","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1296102","tags":["x_refsource_CONFIRM"]},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-68.html","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html","name":"openSUSE-SU-2016:1964","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2486","name":"RHSA-2018:2486","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1036348","name":"1036348","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://support.apple.com/HT206903","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html","name":"openSUSE-SU-2016:1441","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html","name":"openSUSE-SU-2016:2026","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10365","tags":["x_refsource_CONFIRM"]}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"redhat","dateUpdated":"2021-07-31T07:06:39.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749"},"datePublic":"2016-05-17T00:00:00.000Z"},"adp":[{"title":"CVE Program Container","references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2824.html","name":"RHSA-2016:2824","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://www.tenable.com/security/tns-2016-20","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securitytracker.com/id/1037705","name":"1037705","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securitytracker.com/id/1036415","name":"1036415","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-2983-1","name":"USN-2983-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html","name":"openSUSE-SU-2016:1523","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://support.eset.com/ca6333/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/90729","name":"90729","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-3044-1","name":"USN-3044-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/17/12","name":"[oss-security] 20160517 CVE-2016-0718: Expat XML Parser Crashes on Malformed Input","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","name":"APPLE-SA-2016-07-18-1","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html","name":"SUSE-SU-2016:1508","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1236923","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2017/Feb/68","name":"20170227 CVE-2016-9892 - Remote Code Execution as Root via ESET Endpoint Antivirus 6","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201701-21","name":"GLSA-201701-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://source.android.com/security/bulletin/2016-11-01.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.debian.org/security/2016/dsa-3582","name":"DSA-3582","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html","name":"SUSE-SU-2016:1512","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1296102","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-68.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html","name":"openSUSE-SU-2016:1964","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2486","name":"RHSA-2018:2486","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1036348","name":"1036348","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://support.apple.com/HT206903","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html","name":"openSUSE-SU-2016:1441","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html","name":"openSUSE-SU-2016:2026","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10365","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T22:30:03.995Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2016-0718","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T20:58:21.477223Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-08T21:03:22.211Z"}}]}}}