Vulnerability Report

CVE-2015-1283

Title: Python Memory Corruption

Memory Corruption

Proof Of Concept

No public PoC currently indexed for CVE-2015-1283.

CWE Category CWE-190
Published Date Jul 23, 2015
Modified Date May 06, 2026
Exploit Status Not Found
Score 6.8 CVSS v2.0
Exploit Probability (EPSS)
0.52%

Vulnerability Summary

CVE-2015-1283: Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.

Impacted Vendors

P
python 1
T
techland 1
P
python_software_foundation 1
G
google 1
S
suse 2
L
libexpat_project 1
O
opensuse_project 1

Reference Links

http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html http://rhn.redhat.com/errata/RHSA-2015-1499.html http://www.debian.org/security/2015/dsa-3315 http://www.debian.org/security/2015/dsa-3318 http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html http://www.securityfocus.com/bid/75973 http://www.securitytracker.com/id/1033031 http://www.ubuntu.com/usn/USN-2726-1 https://code.google.com/p/chromium/issues/detail?id=492052 https://codereview.chromium.org/1224303003 https://kc.mcafee.com/corporate/index?page=content&id=SB10365 https://security.gentoo.org/glsa/201603-09 https://security.gentoo.org/glsa/201701-21 https://source.android.com/security/bulletin/2016-11-01.html https://www.tenable.com/security/tns-2016-20 http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00010.html http://rhn.redhat.com/errata/RHSA-2015-1499.html http://www.debian.org/security/2015/dsa-3315 http://www.debian.org/security/2015/dsa-3318 http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html http://www.securityfocus.com/bid/75973 http://www.securitytracker.com/id/1033031 http://www.ubuntu.com/usn/USN-2726-1 https://code.google.com/p/chromium/issues/detail?id=492052 https://codereview.chromium.org/1224303003 https://kc.mcafee.com/corporate/index?page=content&id=SB10365 https://security.gentoo.org/glsa/201603-09 https://security.gentoo.org/glsa/201701-21 https://source.android.com/security/bulletin/2016-11-01.html https://www.tenable.com/security/tns-2016-20
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
6.8
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:M/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2015-1283 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.