{"id":"CVE-2016-4472","published":"2016-06-30T17:00:00Z","modified":"2026-10-08T21:03:22Z","title":"The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.11946,"percentile":0.96102,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.tenable.com/security/tns-2016-20","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1344251","tags":["x_refsource_CONFIRM"]},{"url":"http://www.ubuntu.com/usn/USN-3013-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securityfocus.com/bid/91528","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://sourceforge.net/p/expat/code_git/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde","tags":["x_refsource_CONFIRM"]},{"url":"https://security.gentoo.org/glsa/201701-21","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10365","tags":["x_refsource_CONFIRM"]}],"priority":{"score":19.2,"factors":[{"name":"EPSS percentile","points":19.22}]},"euvd":{"id":"EUVD-2016-5459","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2015-2716-family-cve-2015-2716","parents":[{"from":"CVE-2015-2716","to":"CVE-2016-4472","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.","from":"CVE.org","in":"CVE-2016-4472"}]},{"from":"CVE-2015-1283","to":"CVE-2016-4472","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.","from":"CVE.org","in":"CVE-2016-4472"}]}]}}