High
Security advisory
Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-4478
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:10 UTC · Revision 1
Source evidence
Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
osv:CVE-2016-4478
Complete source record
{
"id": "bc801355a97b6cb2d8d3f8f324b7f43dc91b97d5053bfd8a17a6f611abed3e01",
"url": "https://osv.dev/vulnerability/CVE-2016-4478",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-4478",
"summary": "Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.",
"evidence": "osv:CVE-2016-4478",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-4478",
"aliases": [
"CVE-2016-4478"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/atheme/atheme",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "c961688c910803158202b27d4b9237acb100f251"
},
{
"fixed": "87580d767868360d2fed503980129504da84b63e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:atheme:atheme:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "7.2.6"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "87580d767868360d2fed503980129504da84b63e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"atheme-7.2.6",
"atheme-7.2.5",
"atheme-7.2.4",
"atheme-7.2.3",
"atheme-7.2.2",
"atheme-7.2.1",
"atheme-7.2.0",
"atheme-7.2.0-rc2",
"atheme-7.2.0-rc1",
"atheme-7.2.0-beta2",
"atheme-7.2.0-beta1",
"atheme-services-7.1.0-alpha1",
"atheme-services-7.0.0-beta2",
"atheme-services-7.0.0-beta1",
"atheme-services-7.0.0-alpha14",
"atheme-services-7.0.0-alpha13.37",
"atheme-services-7.0.0-alpha13",
"atheme-services-7.0.0-alpha11",
"atheme-services-7.0.0-alpha10",
"atheme-services-7.0.0-alpha9",
"atheme-services-7.0.0-alpha8",
"atheme-services-7.0.0-alpha7",
"atheme-services-7.0.0-alpha6",
"atheme-services-7.0.0-alpha3",
"atheme-services-7.0.0-alpha2",
"atheme-services-7.0-alpha1",
"atheme-services-6.0.0",
"atheme-services-6.0.0-rc2",
"atheme-services-6.0.0-rc1",
"atheme-services-6.0.0-beta3",
"atheme-services-6.0.0-beta2",
"atheme-services-6.0.0-beta1",
"atheme-services-6.0.0-alpha7",
"atheme-services-6.0.0-alpha6",
"atheme-services-6.0.0-alpha3",
"atheme-services-6.0.0-alpha2",
"atheme-6.0.0-alpha1",
"atheme-services-5.2.0",
"atheme-services-5.1.1",
"atheme-services-5.1.0",
"atheme-services-5.1-rc1",
"atheme-services-5.0.1",
"atheme-services-5.0",
"atheme-services-5.0-beta1",
"atheme-services-4.0.1",
"atheme-services-4.0.0",
"atheme-services-3.0.3",
"atheme-services-3.0.2",
"atheme-services-3.0.1",
"atheme-services-3.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4478.json",
"vanir_signatures": [
{
"id": "CVE-2016-4478-34f02fe3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42205439419379173217561027574847435756",
"279842839254015645750451448363378502239",
"130012205762668577428285411191529094442",
"83917961357696884801576035593535001229",
"211077350756679990206601574942213543167"
]
},
"source": "https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e",
"target": {
"file": "modules/transport/xmlrpc/xmlrpclib.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-4478-c2d77b15",
"digest": {
"length": 795,
"function_hash": "291135090142418443225470849783248172328"
},
"source": "https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e",
"target": {
"file": "modules/transport/xmlrpc/xmlrpclib.c",
"function": "xmlrpc_char_encode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:15:42Z"
}
}
],
"modified": "2026-10-20T13:15:42.751156015Z",
"provider": "osv",
"references": [
"https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "42.1"
},
{
"last_affected": "42.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:opensuse",
"extracted_events": [
{
"range": [
{
"introduced": "13.2"
},
{
"last_affected": "13.2"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-4478",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387414,
"published_at": "2016-06-13T19:59:09.02+00:00"
}