CVE-2015-1283

medium · 6.8

Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.

6.8

CVSS

18.4%

EPSS (exploit prob.)

97th

EPSS percentile

2015-07-23

Published

AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

CWE-190

Affected products

Vendor	Product	Affected versions
google	chrome	<= 43.0.2357.134
libexpat_project	libexpat	<= 2.1.0
python	python	>= 2.7.0, < 2.7.12
python	python	>= 3.3.0, < 3.3.7
python	python	>= 3.4.0, < 3.4.5
python	python	>= 3.5.0, < 3.5.2
debian	debian_linux	7.0
debian	debian_linux	8.0
debian	debian_linux	9.0
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	14.04
canonical	ubuntu_linux	15.04
suse	linux_enterprise_debuginfo	11
suse	studio_onsite	1.3
opensuse	leap	42.1
opensuse	opensuse	13.1
opensuse	opensuse	13.2
suse	linux_enterprise_desktop	12
suse	linux_enterprise_desktop	12
suse	linux_enterprise_server	11
suse	linux_enterprise_server	12
suse	linux_enterprise_server	12
suse	linux_enterprise_software_development_kit	11
suse	linux_enterprise_software_development_kit	12
suse	linux_enterprise_software_development_kit	12
oracle	solaris	10
oracle	solaris	11.3

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-1283