Patchfirst
Patchfirst
Chain

CVE-2015-2716 family: incomplete fixes (2015–2016)

3 CVEs over 2 generations, 14 May 2015 to 30 Jun 2016.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2015-271614 May 2015 First in the chain
  2. CVE-2015-128323 Jul 2015 related to CVE-2015-2716
  3. CVE-2016-447230 Jun 2016 incomplete fix for CVE-2015-2716incomplete fix for CVE-2015-1283
May 2015JulAugDecJun 2016 CVE-2015-2716 → CVE-2016-4472: incomplete fix (high confidence)CVE-2015-1283 → CVE-2016-4472: incomplete fix (high confidence)CVE-2015-2716 → CVE-2015-1283: related (low confidence) CVE-2015-2716 14 May 2015 CVE-2015-1283 23 Jul 2015 CVE-2016-4472 30 Jun 2016 May 2015JunJulAugNovFeb 2016Jun CVE-2015-2716 → CVE-2016-4472: incomplete fix (high confidence)CVE-2015-1283 → CVE-2016-4472: incomplete fix (high confidence)CVE-2015-2716 → CVE-2015-1283: related (low confidence) CVE-2015-2716 14 May 2015 CVE-2015-1283 23 Jul 2015 CVE-2016-4472 30 Jun 2016
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2015-2716 14 May 2015 Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before… First in chain 18.9
CVE-2015-1283 23 Jul 2015 Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before… CVE-2015-2716 · related · Low 19.4
CVE-2016-4472 30 Jun 2016 The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote… CVE-2015-2716 · incomplete fix · High 19.2
↑ ↓ chooseEnter openEsc close