{"id":"CVE-2016-0718","title":"Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.","summary":"Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-119"],"vendor":"mozilla","product":"firefox","affected":["firefox < 48.0","mac_os_x >= 10.11.0, <= 10.11.5","linux_enterprise_debuginfo = 11","studio_onsite = 1.3","linux_enterprise_server = 11","linux_enterprise_software_development_kit = 11","leap = 42.1","linux_enterprise_desktop = 12","linux_enterprise_server = 12","linux_enterprise_software_development_kit = 12","ubuntu_linux = 12.04","ubuntu_linux = 14.04","ubuntu_linux = 16.04","libexpat < 2.2.0","debian_linux = 8.0","opensuse = 13.1","opensuse = 13.2","policy_auditor < 6.5.1","python >= 2.7.0, < 2.7.15","python >= 3.3.0, < 3.3.7","python >= 3.4.0, < 3.4.7","python >= 3.5.0, < 3.5.4","python >= 3.6.0, < 3.6.2"],"patched":["firefox 48.0","libexpat 2.2.0","policy_auditor 6.5.1","python 3.6.2"],"published":"2016-05-26","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:17:04.667","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2016-0718","references":[{"url":"http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","label":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html","label":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html","label":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html","label":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html","label":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html","label":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html","label":"secalert@redhat.com"},{"url":"http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html","label":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2824.html","label":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2017/Feb/68","label":"secalert@redhat.com"},{"url":"http://support.eset.com/ca6333/","label":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2016/dsa-3582","label":"secalert@redhat.com"},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-68.html","label":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2016/05/17/12","label":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","label":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","label":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/90729","label":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1036348","label":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1036415","label":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1037705","label":"secalert@redhat.com"},{"url":"http://www.ubuntu.com/usn/USN-2983-1","label":"secalert@redhat.com"},{"url":"http://www.ubuntu.com/usn/USN-3044-1","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:2486","label":"secalert@redhat.com"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1236923","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1296102","label":"secalert@redhat.com"},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10365","label":"secalert@redhat.com"},{"url":"https://security.gentoo.org/glsa/201701-21","label":"secalert@redhat.com"},{"url":"https://source.android.com/security/bulletin/2016-11-01.html","label":"secalert@redhat.com"},{"url":"https://support.apple.com/HT206903","label":"secalert@redhat.com"},{"url":"https://www.tenable.com/security/tns-2016-20","label":"secalert@redhat.com"},{"url":"http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2824.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2017/Feb/68","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://support.eset.com/ca6333/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2016/dsa-3582","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-68.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2016/05/17/12","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/90729","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1036348","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1036415","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1037705","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2983-1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-3044-1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:2486","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1236923","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1296102","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10365","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201701-21","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://source.android.com/security/bulletin/2016-11-01.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT206903","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2016-20","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.13335,"epssPercentile":0.96326,"ingestedAt":"2026-10-08T22:11:53.690Z","slug":"CVE-2016-0718","body":"## Overview\n\nExpat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.\n\n## Affected\n\n- `firefox < 48.0`\n- `mac_os_x >= 10.11.0, <= 10.11.5`\n- `linux_enterprise_debuginfo = 11`\n- `studio_onsite = 1.3`\n- `linux_enterprise_server = 11`\n- `linux_enterprise_software_development_kit = 11`\n- `leap = 42.1`\n- `linux_enterprise_desktop = 12`\n- `linux_enterprise_server = 12`\n- `linux_enterprise_software_development_kit = 12`\n- `ubuntu_linux = 12.04`\n- `ubuntu_linux = 14.04`\n- `ubuntu_linux = 16.04`\n- `libexpat < 2.2.0`\n- `debian_linux = 8.0`\n- `opensuse = 13.1`\n- `opensuse = 13.2`\n- `policy_auditor < 6.5.1`\n- `python >= 2.7.0, < 2.7.15`\n- `python >= 3.3.0, < 3.3.7`\n- `python >= 3.4.0, < 3.4.7`\n- `python >= 3.5.0, < 3.5.4`\n- `python >= 3.6.0, < 3.6.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `firefox 48.0`\n- `libexpat 2.2.0`\n- `policy_auditor 6.5.1`\n- `python 3.6.2`","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":53.9,"likelihood":2.7,"exploitation":0,"ransomware":0},"changes":[]}