CVE-2016-4448

CWE-134 — Uncontrolled Format String17 documents9 sources
Severity
9.8CRITICAL
EPSS
1.2%
top 21.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
19
Apple IcloudApple MAC OS XApple Iphone OS+16 more
Timeline
PublishedJun 9
Latest updateMay 13

Description

Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages18 packages

▶Debianlibxml2< 2.9.4+dfsg1-1+3
▶Ubuntulibxml2< 2.9.1+dfsg1-3ubuntu4.9+1
▶NVDxmlsoft/libxml22.9.3
▶NVDapple/icloud< 5.2.1
▶NVDapple/mac_os_x< 10.11.6

Also affects: Enterprise Linux 7.2, 7.3, 7.4, 7.6, 7.7, 7.5

🔴Vulnerability Details

4
GHSA
GHSA-wfj9-g4pj-c38g: Format string vulnerability in libxml2 before 2↗2022-05-13
▶
OSV
libxml2 vulnerabilities↗2017-03-16
▶
CVEList
CVE-2016-4448: Format string vulnerability in libxml2 before 2↗2016-06-09
▶
OSV
CVE-2016-4448: Format string vulnerability in libxml2 before 2↗2016-06-09
▶

📋Vendor Advisories

9
Ubuntu
libxml2 vulnerabilities↗2017-03-16
▶
Apple
CVE-2016-4448: OS X El Capitan v10.11.6 and Security Update 2016-004↗2016-07-18
▶
Apple
CVE-2016-4448: iTunes 12.4.2 for Windows↗2016-07-18
▶
Apple
CVE-2016-4448: iCloud for Windows 5.2.1↗2016-07-18
▶
Apple
CVE-2016-4448: watchOS 2.2.2↗2016-07-18
▶

💬Community

3
Bugzilla
CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1836 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-4447 CVE-2016-4448 CVE-2016-4449 libxml2: various flaws [fedora-a↗2016-06-24
▶
Bugzilla
CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1836 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-4447 CVE-2016-4448 CVE-2016-4449 mingw-libxml2: various flaws [fe↗2016-06-24
▶
Bugzilla
CVE-2016-4448 libxml2: Format string vulnerability↗2016-05-23
▶