critical
CVE-2016-0718
expat: Out-of-bounds heap read on crafted input causing crash
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Ubuntu (medium).
Description
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.4 | expat | 2.1.1-r1 |
| amazon linux 1 | expat, expat-debuginfo, expat-devel | 2.1.0-10.21.amzn1 |
| debian 11 | expat, libxmltok | 2.1.1-2 |
| debian 12 | expat, libxmltok | 2.1.1-2 |
| debian 13 | expat | 2.1.1-2 |
| debian 14 | expat | 2.1.1-2 |
| debian 7 | expat | 2.1.0-1+deb7u3 |
| debian 8 | expat | 2.1.0-6+deb8u2 |
| echo | expat, libxmltok | 2.1.1-2 |
| Oracle Linux 6 | expat, expat-devel | 2.0.1-13.el6_8 |
| Oracle Linux 7 | expat, expat-devel, expat-static | 2.1.0-10.el7_3 |
| rapidfort debian 12 | libxmltok | 0:1.2-4.1 |
Show all 113 entries from 51 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.4 | expat | 2.1.1-r1 |
| amazon linux 1 | expat | 2.1.0-10.21.amzn1 |
| amazon linux 1 | expat-debuginfo | 2.1.0-10.21.amzn1 |
| amazon linux 1 | expat-devel | 2.1.0-10.21.amzn1 |
| debian 11 | expat | 2.1.1-2 |
| debian 11 | libxmltok | no fix listed |
| debian 12 | expat | 2.1.1-2 |
| debian 12 | libxmltok | no fix listed |
| debian 13 | expat | 2.1.1-2 |
| debian 14 | expat | 2.1.1-2 |
| debian 7 | expat | 2.1.0-1+deb7u3 |
| debian 8 | expat | 2.1.0-6+deb8u2 |
| echo | expat | 2.1.1-2 |
| echo | libxmltok | no fix listed |
| Oracle Linux 6 | expat | 2.0.1-13.el6_8 |
| Oracle Linux 6 | expat-devel | 2.0.1-13.el6_8 |
| Oracle Linux 7 | expat | 2.1.0-10.el7_3 |
| Oracle Linux 7 | expat-devel | 2.1.0-10.el7_3 |
| Oracle Linux 7 | expat-static | 2.1.0-10.el7_3 |
| rapidfort debian 12 | libxmltok | 0:1.2-4.1 |
| rapidfort debian 13 | libxmltok | 0:1.2-4.1 |
| rapidfort fedora 43 | python3.15 | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-debug | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-devel | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-freethreading | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-freethreading-debug | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-freethreading-devel | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-freethreading-idle | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-freethreading-libs | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-freethreading-test | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-freethreading-tkinter | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-idle | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-libs | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-test | 3.15.0-1.fc43 |
| rapidfort fedora 43 | python3.15-tkinter | 3.15.0-1.fc43 |
| rapidfort ubuntu 20.04 | cadaver | no fix listed |
| rapidfort ubuntu 20.04 | matanza | no fix listed |
| rapidfort ubuntu 20.04 | swish-e | no fix listed |
| rapidfort ubuntu 22.04 | cadaver | no fix listed |
| rapidfort ubuntu 22.04 | matanza | no fix listed |
| rapidfort ubuntu 22.04 | swish-e | no fix listed |
| rapidfort ubuntu 24.04 | cadaver | no fix listed |
| rapidfort ubuntu 24.04 | matanza | no fix listed |
| rapidfort ubuntu 24.04 | swish-e | no fix listed |
| Red Hat | compat-expat1 | no fix listed |
| root.io debian 11 | rootio-expat | 2.1.1-2 |
| root.io debian 12 | rootio-expat | 2.1.1-2 |
| root.io debian 13 | rootio-expat | 2.1.1-2 |
| seal Red Hat 6 | expat | 2.0.1-15.el6_10+sp999 |
| seal Red Hat 6 | seal-expat | 2.0.1-15.el6_10+sp999 |
| ubuntu 12.04 | expat | 2.0.1-7.2ubuntu1.3 |
| ubuntu 12.04 | firefox | 48.0+build2-0ubuntu0.12.04.1 |
| ubuntu 12.04 | xmlrpc-c | 1.16.33-3.1ubuntu5.2 |
| ubuntu 14.04 | expat | 2.1.0-4ubuntu1.2 |
| ubuntu 14.04 | firefox | 48.0+build2-0ubuntu0.14.04.1 |
| ubuntu 14.04-ESM | expat | 2.1.0-4ubuntu1.2 |
| ubuntu 15.10 | expat | 2.1.0-7ubuntu0.15.10.1 |
| ubuntu 16.04 | expat | 2.1.0-7ubuntu0.16.04.1 |
| ubuntu 16.04 | firefox | 48.0+build2-0ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | expat | 2.1.0-7ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | libxmltok | 1.2-3ubuntu0.16.04.1~esm2 |
| ubuntu 16.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 17.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 17.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 18.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 18.04-ESM | cadaver | no fix listed |
| ubuntu 18.04-ESM | coin3 | no fix listed |
| ubuntu 18.04-ESM | expat | 2.1.1-1ubuntu1 |
| ubuntu 18.04-ESM | libxmltok | 1.2-4ubuntu0.18.04.1~esm4 |
| ubuntu 18.04-ESM | swish-e | no fix listed |
| ubuntu 18.04-ESM | xmlrpc-c | no fix listed |
| ubuntu 18.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 19.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 19.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 20.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 20.04-ESM | cadaver | no fix listed |
| ubuntu 20.04-ESM | coin3 | no fix listed |
| ubuntu 20.04-ESM | expat | 2.1.1-1ubuntu1 |
| ubuntu 20.04-ESM | libxmltok | 1.2-4ubuntu0.20.04.1~esm4 |
| ubuntu 20.04-ESM | swish-e | no fix listed |
| ubuntu 20.04-ESM | xmlrpc-c | no fix listed |
| ubuntu 20.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 21.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 21.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 22.04 | cadaver | no fix listed |
| ubuntu 22.04 | coin3 | no fix listed |
| ubuntu 22.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 22.04 | libxmltok | no fix listed |
| ubuntu 22.04 | swish-e | no fix listed |
| ubuntu 22.04 | xmlrpc-c | no fix listed |
| ubuntu 22.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 23.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 23.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 24.04 | cadaver | no fix listed |
| ubuntu 24.04 | coin3 | no fix listed |
| ubuntu 24.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 24.04 | libxmltok | no fix listed |
| ubuntu 24.04 | swish-e | no fix listed |
| ubuntu 24.04 | xmlrpc-c | no fix listed |
| ubuntu 24.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 24.10 | libxmltok | 1.2-4.1ubuntu3.1 |
| ubuntu 25.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 25.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 26.04 | cadaver | no fix listed |
| ubuntu 26.04 | coin3 | no fix listed |
| ubuntu 26.04 | expat | 2.1.1-1ubuntu1 |
| ubuntu 26.04 | swish-e | no fix listed |
| ubuntu 26.04 | xmlrpc-c | no fix listed |
| ubuntu 26.10 | cadaver | no fix listed |
| ubuntu 26.10 | coin3 | no fix listed |
| ubuntu 26.10 | expat | 2.1.1-1ubuntu1 |
| ubuntu 26.10 | swish-e | no fix listed |
| ubuntu 26.10 | xmlrpc-c | no fix listed |
References
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html
- http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html
All 40 references
- http://rhn.redhat.com/errata/RHSA-2016-2824.html
- http://seclists.org/fulldisclosure/2017/Feb/68
- http://support.eset.com/ca6333/
- http://www.debian.org/security/2016/dsa-3582
- http://www.mozilla.org/security/announce/2016/mfsa2016-68.html
- http://www.openwall.com/lists/oss-security/2016/05/17/12
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.securityfocus.com/bid/90729
- http://www.securitytracker.com/id/1036348
- http://www.securitytracker.com/id/1036415
- http://www.securitytracker.com/id/1037705
- http://www.ubuntu.com/usn/USN-2983-1
- http://www.ubuntu.com/usn/USN-3044-1
- https://access.redhat.com/errata/RHSA-2018:2486
- https://access.redhat.com/security/cve/CVE-2016-0718
- https://bugzilla.mozilla.org/show_bug.cgi?id=1236923
- https://bugzilla.redhat.com/show_bug.cgi?id=1296102
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://linux.oracle.com/cve/CVE-2016-0718.html
- https://linux.oracle.com/errata/ELSA-2016-2824.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-0718
- https://security.gentoo.org/glsa/201701-21
- https://source.android.com/security/bulletin/2016-11-01.html
- https://support.apple.com/HT206903
- https://ubuntu.com/security/notices/USN-2983-1
- https://ubuntu.com/security/notices/USN-3013-1
- https://ubuntu.com/security/notices/USN-3044-1
- https://ubuntu.com/security/notices/USN-5455-1
- https://ubuntu.com/security/notices/USN-7199-1
- https://www.cve.org/CVERecord?id=CVE-2016-0718
- https://www.tenable.com/security/tns-2016-20