CVE-2016-4478
UnknownEPSS 2.27%
Last modified
CVE-2016-4478 is a vulnerability of currently unknown severity. Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.. EPSS estimates a 2.27% chance of exploitation in the next 30 days.
Description
Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Leap | 42.1 |
| Opensuse | Opensuse | 13.2 |
| Atheme | Atheme | <= 7.2.6 |
| Debian | Debian Linux | 8.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-4478?
Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
How severe is CVE-2016-4478?
Severity scoring for CVE-2016-4478 is pending analysis. The EPSS model estimates a 2.27% probability of exploitation in the next 30 days.
How do I fix CVE-2016-4478?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-4472The overflow protection in Expat is removed by compilers wit…8.1
- CVE-2016-4473/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote…
- CVE-2016-4474The image build process for the overcloud images in Red Hat …
- CVE-2016-4475The (1) Organization and (2) Locations APIs and UIs in Forem…
- CVE-2016-4476hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2…7.5
- CVE-2016-4477wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r c…
- CVE-2016-4480The guest_walk_tables function in arch/x86/mm/guest_walk.c i…
- CVE-2016-4482The proc_connectinfo function in drivers/usb/core/devio.c in…
- CVE-2016-4483The xmlBufAttrSerializeTxtContent function in xmlsave.c in l…7.5
- CVE-2016-4484The Debian initrd script for the cryptsetup package 2:1.7.3-…
- CVE-2016-4485The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux k…
- CVE-2016-4486The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in…
Are you affected by CVE-2016-4478?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST