The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
CVE-2016-5300 - High Severity Vulnerability
Educational Linux Distribution
Library home page: https://sourceforge.net/projects/buffalo-gpl/
Found in HEAD commit: f21d202d4f8bf8d80e786f6bed8eb5a9d9049868
Found in base branch: master
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
Publish Date: 2016-06-16
URL: CVE-2016-5300
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-5300
Release Date: 2016-06-16
Fix Resolution: 2.2.0
Step up your Open Source Security Game with Mend here