--- id: CVE-2016-0718 title: >- Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. summary: >- Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. severity: critical cvss: 9.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-119 vendor: mozilla product: firefox affected: - firefox < 48.0 - 'mac_os_x >= 10.11.0, <= 10.11.5' - linux_enterprise_debuginfo = 11 - studio_onsite = 1.3 - linux_enterprise_server = 11 - linux_enterprise_software_development_kit = 11 - leap = 42.1 - linux_enterprise_desktop = 12 - linux_enterprise_server = 12 - linux_enterprise_software_development_kit = 12 - ubuntu_linux = 12.04 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - libexpat < 2.2.0 - debian_linux = 8.0 - opensuse = 13.1 - opensuse = 13.2 - policy_auditor < 6.5.1 - 'python >= 2.7.0, < 2.7.15' - 'python >= 3.3.0, < 3.3.7' - 'python >= 3.4.0, < 3.4.7' - 'python >= 3.5.0, < 3.5.4' - 'python >= 3.6.0, < 3.6.2' patched: - firefox 48.0 - libexpat 2.2.0 - policy_auditor 6.5.1 - python 3.6.2 published: '2016-05-26' updated: '2026-10-08' sourceUpdated: '2026-10-08T21:17:04.667' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2016-0718' references: - url: 'http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html' label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html' label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html' label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html' label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html' label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html' label: secalert@redhat.com - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html' label: secalert@redhat.com - url: >- http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html label: secalert@redhat.com - url: 'http://rhn.redhat.com/errata/RHSA-2016-2824.html' label: secalert@redhat.com - url: 'http://seclists.org/fulldisclosure/2017/Feb/68' label: secalert@redhat.com - url: 'http://support.eset.com/ca6333/' label: secalert@redhat.com - url: 'http://www.debian.org/security/2016/dsa-3582' label: secalert@redhat.com - url: 'http://www.mozilla.org/security/announce/2016/mfsa2016-68.html' label: secalert@redhat.com - url: 'http://www.openwall.com/lists/oss-security/2016/05/17/12' label: secalert@redhat.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html label: secalert@redhat.com - url: >- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html label: secalert@redhat.com - url: 'http://www.securityfocus.com/bid/90729' label: secalert@redhat.com - url: 'http://www.securitytracker.com/id/1036348' label: secalert@redhat.com - url: 'http://www.securitytracker.com/id/1036415' label: secalert@redhat.com - url: 'http://www.securitytracker.com/id/1037705' label: secalert@redhat.com - url: 'http://www.ubuntu.com/usn/USN-2983-1' label: secalert@redhat.com - url: 'http://www.ubuntu.com/usn/USN-3044-1' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:2486' label: secalert@redhat.com - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=1236923' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1296102' label: secalert@redhat.com - url: 'https://kc.mcafee.com/corporate/index?page=content&id=SB10365' label: secalert@redhat.com - url: 'https://security.gentoo.org/glsa/201701-21' label: secalert@redhat.com - url: 'https://source.android.com/security/bulletin/2016-11-01.html' label: secalert@redhat.com - url: 'https://support.apple.com/HT206903' label: secalert@redhat.com - url: 'https://www.tenable.com/security/tns-2016-20' label: secalert@redhat.com - url: 'http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://rhn.redhat.com/errata/RHSA-2016-2824.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2017/Feb/68' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://support.eset.com/ca6333/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.debian.org/security/2016/dsa-3582' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.mozilla.org/security/announce/2016/mfsa2016-68.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2016/05/17/12' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/90729' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1036348' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1036415' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1037705' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.ubuntu.com/usn/USN-2983-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.ubuntu.com/usn/USN-3044-1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:2486' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=1236923' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1296102' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://kc.mcafee.com/corporate/index?page=content&id=SB10365' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/201701-21' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://source.android.com/security/bulletin/2016-11-01.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/HT206903' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.tenable.com/security/tns-2016-20' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.13335 epssPercentile: 0.96326 ingestedAt: '2026-10-08T22:11:53.690Z' --- ## Overview Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. ## Affected - `firefox < 48.0` - `mac_os_x >= 10.11.0, <= 10.11.5` - `linux_enterprise_debuginfo = 11` - `studio_onsite = 1.3` - `linux_enterprise_server = 11` - `linux_enterprise_software_development_kit = 11` - `leap = 42.1` - `linux_enterprise_desktop = 12` - `linux_enterprise_server = 12` - `linux_enterprise_software_development_kit = 12` - `ubuntu_linux = 12.04` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `libexpat < 2.2.0` - `debian_linux = 8.0` - `opensuse = 13.1` - `opensuse = 13.2` - `policy_auditor < 6.5.1` - `python >= 2.7.0, < 2.7.15` - `python >= 3.3.0, < 3.3.7` - `python >= 3.4.0, < 3.4.7` - `python >= 3.5.0, < 3.5.4` - `python >= 3.6.0, < 3.6.2` ## Remediation Upgrade past the affected range: - `firefox 48.0` - `libexpat 2.2.0` - `policy_auditor 6.5.1` - `python 3.6.2`