CVE catalog

CVE-2016-9063

libxmltok: CVE-2016-9063

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.36% · Oct 27, 2026

An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianexpatsid2.9.0-1fixed
Debianexpatforky2.9.0-1fixed
Debianexpattrixie2.8.3-1~deb13u1fixed
Debianexpattrixie-security2.9.0-1~deb13u1fixed
Debianexpatbookworm2.5.0-1+deb12u2fixed
Debianexpatbookworm-security2.5.0-1+deb12u5fixed
Debianlibxmltokbookworm1.2-4vulnerable
Debianfirefox-esrsid153.6.0esr-1not affected
Debianfirefox-esrforky153.5.1esr-1not affected
Debianfirefox-esrtrixie140.15.0esr-1~deb13u1not affected
Debianfirefox-esrtrixie-security153.6.0esr-1~deb13u1not affected
Debianfirefox-esrbookworm140.12.0esr-1~deb12u1not affected
Debianfirefox-esrbookworm-security153.6.0esr-1~deb12u2not affected
CpefirefoxNot reported50fixed
Cpedebian_linuxNot reportedNot reportedunknown
CpepythonNot reported3.6.2fixed
Ubuntufirefox14.0424.0+build1-0ubuntu1vulnerable
Ubuntufirefox14.0425.0+build3-0ubuntu0.13.10.1vulnerable
Ubuntufirefox14.0428.0~b2+build1-0ubuntu2vulnerable
Ubuntufirefox14.0428.0+build1-0ubuntu1vulnerable
Ubuntufirefox14.0428.0+build2-0ubuntu1vulnerable
Ubuntufirefox14.0428.0+build2-0ubuntu2vulnerable
Ubuntufirefox14.0429.0+build1-0ubuntu0.14.04.2vulnerable
Ubuntufirefox14.0430.0+build1-0ubuntu0.14.04.3vulnerable
Ubuntufirefox14.0431.0+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0432.0+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0432.0.3+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0433.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0434.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0435.0+build3-0ubuntu0.14.04.2vulnerable
Ubuntufirefox14.0435.0.1+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0436.0+build2-0ubuntu0.14.04.4vulnerable
Ubuntufirefox14.0436.0.1+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0436.0.4+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0437.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0437.0.1+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0437.0.2+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0438.0+build3-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0439.0+build5-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0439.0.3+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0440.0+build4-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0440.0+build4-0ubuntu0.14.04.4vulnerable
Ubuntufirefox14.0440.0.3+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0441.0+build3-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0441.0.1+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0441.0.2+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0442.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0443.0+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0443.0.4+build3-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0444.0+build3-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0444.0.1+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0444.0.2+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0445.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0445.0.1+build1-0ubuntu0.14.04.2vulnerable
Ubuntufirefox14.0445.0.2+build1-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0446.0+build5-0ubuntu0.14.04.2vulnerable
Ubuntufirefox14.0446.0.1+build1-0ubuntu0.14.04.3vulnerable
Ubuntufirefox14.0447.0+build3-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0448.0+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0449.0+build4-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0449.0.2+build2-0ubuntu0.14.04.1vulnerable
Ubuntufirefox14.0450.0+build2-0ubuntu0.14.04.2fixed
Ubuntufirefox16.0441.0.2+build2-0ubuntu1vulnerable
Ubuntufirefox16.0442.0+build2-0ubuntu1vulnerable
Ubuntufirefox16.0444.0+build3-0ubuntu2vulnerable
Ubuntufirefox16.0444.0.1+build1-0ubuntu1vulnerable
Ubuntufirefox16.0444.0.2+build1-0ubuntu1vulnerable
Ubuntufirefox16.0445.0+build2-0ubuntu1vulnerable
Ubuntufirefox16.0445.0.1+build1-0ubuntu1vulnerable
Ubuntufirefox16.0445.0.2+build1-0ubuntu1vulnerable
Ubuntufirefox16.0446.0+build5-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0446.0.1+build1-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0447.0+build3-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0448.0+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0449.0+build4-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0449.0.2+build2-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0450.0+build2-0ubuntu0.16.04.2fixed
Suseexpatlinux enterprise desktop 12 sp22.1.0-21.3.1fixed
Suseexpatlinux enterprise desktop 12 sp32.1.0-21.3.1fixed
Suseexpatlinux enterprise server for raspberry pi 12 sp22.1.0-21.3.1fixed
Suseexpatlinux enterprise software development kit 12 sp22.1.0-21.3.1fixed
Suseexpatlinux enterprise software development kit 12 sp32.1.0-21.3.1fixed
Suseexpatlinux enterprise server 12 sp22.1.0-21.3.1fixed
Suseexpatlinux enterprise server for sap applications 12 sp22.1.0-21.3.1fixed
Suseexpatlinux enterprise server 12 sp32.1.0-21.3.1fixed
Suseexpatlinux enterprise server for sap applications 12 sp32.1.0-21.3.1fixed
Suseexpatlinux enterprise software development kit 11 sp42.0.1-88.42.3.2fixed
Suseexpatlinux enterprise server 11 sp42.0.1-88.42.3.2fixed
Suseexpatlinux enterprise server for sap applications 11 sp42.0.1-88.42.3.2fixed
Suseexpatstudio onsite 1.32.0.1-88.42.3.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianexpatsourcesid2.2.0-2not yet assignedNot reportedNot reported
Debianexpatsourceforky2.2.0-2not yet assignedNot reportedNot reported
Debianexpatsourcetrixie2.2.0-2not yet assignedNot reportedNot reported
Debianexpatsourcebookworm2.2.0-2not yet assignedNot reportedNot reported
Debianlibxmltoksourcebookworm(unfixed)not yet assignedNot reportedNot reported
Debianfirefox-esrsourcesidNot affectedunimportantNot reportedNot reported
Debianfirefox-esrsourceforkyNot affectedunimportantNot reportedNot reported
Debianfirefox-esrsourcetrixieNot affectedunimportantNot reportedNot reported
Debianfirefox-esrsourcebookwormNot affectedunimportantNot reportedNot reported
CpefirefoxcpeNot reported50Not reportedNVD-CVE-2016-9063Not reported
CpepythoncpeNot reported3.6.2Not reportedNVD-CVE-2016-9063Not reported
Ubuntufirefoxdeb14.0450.0+build2-0ubuntu0.14.04.2Not reportedUBUNTU-CVE-2016-9063Not reported
Ubuntufirefoxdeb16.0450.0+build2-0ubuntu0.16.04.2Not reportedUBUNTU-CVE-2016-9063Not reported
Suseexpatrpmlinux enterprise desktop 12 sp22.1.0-21.3.1Not reportedSUSE-SU-2017:2299-1Not reported
Suseexpatrpmlinux enterprise desktop 12 sp32.1.0-21.3.1Not reportedSUSE-SU-2017:2299-1Not reported
Suseexpatrpmlinux enterprise server for raspberry pi 12 sp22.1.0-21.3.1Not reportedSUSE-SU-2017:2299-1Not reported
Suseexpatrpmlinux enterprise software development kit 12 sp22.1.0-21.3.1Not reportedSUSE-SU-2017:2299-1Not reported
Suseexpatrpmlinux enterprise software development kit 12 sp32.1.0-21.3.1Not reportedSUSE-SU-2017:2299-1Not reported
Suseexpatrpmlinux enterprise server 12 sp22.1.0-21.3.1Not reportedSUSE-SU-2017:2299-1Not reported
Suseexpatrpmlinux enterprise server for sap applications 12 sp22.1.0-21.3.1Not reportedSUSE-SU-2017:2299-1Not reported
Suseexpatrpmlinux enterprise server 12 sp32.1.0-21.3.1Not reportedSUSE-SU-2017:2299-1Not reported
Suseexpatrpmlinux enterprise server for sap applications 12 sp32.1.0-21.3.1Not reportedSUSE-SU-2017:2299-1Not reported
Suseexpatrpmlinux enterprise software development kit 11 sp42.0.1-88.42.3.2Not reportedSUSE-SU-2017:2375-1Not reported
Suseexpatrpmlinux enterprise server 11 sp42.0.1-88.42.3.2Not reportedSUSE-SU-2017:2375-1Not reported
Suseexpatrpmlinux enterprise server for sap applications 11 sp42.0.1-88.42.3.2Not reportedSUSE-SU-2017:2375-1Not reported
Suseexpatrpmstudio onsite 1.32.0.1-88.42.3.2Not reportedSUSE-SU-2017:2375-1Not reported

Notes

[bookworm] libxmltok: Minor issue, no runtime dependencies left

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [expat]Unknown
    Details (4)
    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.2.0-2

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.2.0-2

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 2.2.0-2

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 2.2.0-2

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

  • [firefox-esr]Unknown
    Details (4)
    • 140.12.0esr-1~deb12u1 · amd64 · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · arm64 · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · amd64 · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · arm64 · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

  • Source package: [firefox-esr]

    Details (4)
    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.12.0esr-1~deb12u1 · all · bookworm

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

    • 140.14.0esr-1~deb12u1 · all · bookworm-security

      Not affected

      dsa · firefox-esr · debian · bookworm

Next results

Observed:

References