CVE-2016-20037 - Vulnerability Analysis

Overview

xwpe <= 1.5.30a-2.1 contains a stack-based buffer overflow caused by overly long input strings exceeding buffer boundaries, letting local attackers execute arbitrary code or cause denial of service, exploit requires local access.

Severity & Score

Impact

Local attackers can execute arbitrary code or cause denial of service by overflowing buffer with crafted input.

Mitigation

Update to the latest version of xwpe.

References

• http://www.identicalsoftware.com/xwpe
• https://www.exploit-db.com/exploits/39285
• https://www.vulncheck.com/advisories/xwpe-30a-stack-based-buffer-overflow

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner