CVE-2016-4472
Fixed in a distro release EPSS 12%
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
Products: libexpat_project libexpat, canonical ubuntu_linux, mcafee policy_auditor, python
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.4 | expat | 2.1.1-r2 |
| Debian 12 | expat | 2.1.1-2 |
| Debian 12 | libxmltok | no fix |
| Debian 13 | expat | 2.1.1-2 |
| Debian 14 | expat | 2.1.1-2 |
| Debian 7 | expat | 2.1.0-1+deb7u3 |
| Debian 8 | expat | 2.1.0-6+deb8u2 |
| SUSE Enterprise Storage 5 | python3 | 3.4.10-25.39.3 |
| SUSE Enterprise Storage 5 | python3-base | 3.4.10-25.39.2 |
| SUSE HPE Helion OpenStack 8 | python3 | 3.4.10-25.39.3 |
| SUSE HPE Helion OpenStack 8 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Desktop 12 SP4 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Desktop 12 SP4 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server 12 SP2-BCL | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server 12 SP3-BCL | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server 12 SP3-BCL | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server 12 SP4 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server 12 SP4 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server 12 SP5 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server 12 SP5 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | python3-base | 3.4.10-25.39.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | python3 | 3.4.10-25.39.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | python3-base | 3.4.10-25.39.2 |
| SUSE OpenStack Cloud 7 | python3 | 3.4.10-25.39.3 |
| SUSE OpenStack Cloud 7 | python3-base | 3.4.10-25.39.2 |
| SUSE OpenStack Cloud 8 | python3 | 3.4.10-25.39.3 |
| SUSE OpenStack Cloud 8 | python3-base | 3.4.10-25.39.2 |
| SUSE OpenStack Cloud Crowbar 8 | python3 | 3.4.10-25.39.3 |
| SUSE OpenStack Cloud Crowbar 8 | python3-base | 3.4.10-25.39.2 |
| Ubuntu 16.04 LTS | cadaver | no fix |
| Ubuntu 16.04 LTS | matanza | no fix |
| Ubuntu 18.04 LTS | cadaver | no fix |
| Ubuntu 18.04 LTS | matanza | no fix |
| Ubuntu 18.04 LTS | vnc4 | no fix |
| Ubuntu 20.04 LTS | cadaver | no fix |
| Ubuntu 20.04 LTS | coin3 | no fix |
| Ubuntu 20.04 LTS | matanza | no fix |
| Ubuntu 22.04 LTS | cadaver | no fix |
| Ubuntu 22.04 LTS | coin3 | no fix |
| Ubuntu 22.04 LTS | matanza | no fix |
| Ubuntu 24.04 LTS | cadaver | no fix |
| Ubuntu 24.04 LTS | coin3 | no fix |
| Ubuntu 24.04 LTS | matanza | no fix |
| Ubuntu 25.10 | cadaver | no fix |
| Ubuntu 25.10 | coin3 | no fix |
| Ubuntu 25.10 | matanza | no fix |
| Ubuntu 25.10 | sitecopy | no fix |
| Ubuntu 25.10 | swish-e | no fix |
| Ubuntu 25.10 | xmlrpc-c | no fix |
| Ubuntu 26.04 LTS | cadaver | no fix |
| Ubuntu 26.04 LTS | coin3 | no fix |
| Ubuntu 26.04 LTS | matanza | no fix |
| Ubuntu 26.04 LTS | sitecopy | no fix |
| Ubuntu 26.04 LTS | xmlrpc-c | no fix |
| Ubuntu 26.10 | cadaver | no fix |
| Ubuntu 26.10 | coin3 | no fix |
| Ubuntu 26.10 | matanza | no fix |
| Ubuntu 26.10 | sitecopy | no fix |
| Ubuntu 26.10 | swish-e | no fix |
| Ubuntu 26.10 | xmlrpc-c | no fix |
| Ubuntu Pro 14.04 LTS | coin3 | no fix |
| Ubuntu Pro 14.04 LTS | vnc4 | no fix |
| Ubuntu Pro 14.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 16.04 LTS | ayttm | no fix |
| Ubuntu Pro 16.04 LTS | cableswig | no fix |
| Ubuntu Pro 16.04 LTS | coin3 | no fix |
| Ubuntu Pro 16.04 LTS | insighttoolkit | no fix |
| Ubuntu Pro 16.04 LTS | libxmltok | 1.2-3ubuntu0.16.04.1~esm2 |
| Ubuntu Pro 16.04 LTS | swish-e | no fix |
| Ubuntu Pro 16.04 LTS | vnc4 | no fix |
| Ubuntu Pro 16.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 18.04 LTS | coin3 | no fix |
| Ubuntu Pro 18.04 LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm1 |
| Ubuntu Pro 18.04 LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm4 |
| Ubuntu Pro 18.04 LTS | swish-e | no fix |
| Ubuntu Pro 18.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 20.04 LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm4 |
| Ubuntu Pro 20.04 LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm1 |
| Ubuntu Pro 20.04 LTS | swish-e | no fix |
| Ubuntu Pro 20.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 22.04 LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm1 |
| Ubuntu Pro 22.04 LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm4 |
| Ubuntu Pro 22.04 LTS | swish-e | no fix |
| Ubuntu Pro 22.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 24.04 LTS | libxmltok | 1.2-4.1ubuntu2.24.0.4.1+esm2 |
| Ubuntu Pro 24.04 LTS | swish-e | no fix |
| Ubuntu Pro 24.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 26.04 LTS | swish-e | no fix |
| openSUSE Tumbleweed | expat | 2.2.0-3.1 |