CVE-2016-4658

CWE-119 — Buffer OverflowCWE-416 — Use After Free18 documents10 sources
Severity
9.8CRITICAL
EPSS
17.7%
top 4.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apple Iphone OSApple MAC OS XApple Tvos+2 more
Timeline
PublishedSep 25
Latest updateAug 21

Description

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages7 packages

▶NVDapple/tvos< 10.0
▶NVDapple/watchos< 3.0
▶NVDapple/mac_os_x< 10.12
▶NVDapple/iphone_os< 10.0
▶NVDxmlsoft/libxml2< 2.9.5

Patches

Patch: git.gnome.org ↗Patch: git.gnome.org ↗

🔴Vulnerability Details

5
GHSA
Nokogiri does not forbid namespace nodes in XPointer ranges↗2018-08-21
▶
OSV
Nokogiri does not forbid namespace nodes in XPointer ranges↗2018-08-21
▶
OSV
libxml2 vulnerabilities↗2017-03-16
▶
CVEList
CVE-2016-4658: xpointer↗2016-09-25
▶
OSV
CVE-2016-4658: xpointer↗2016-09-25
▶

📋Vendor Advisories

8
Android
CVE-2016-4658: Android Security Bulletin 2017-06-01 CVE: CVE-2016-4658 Severity: HIGH Type: RCE Affected AOSP versions: 4↗2017-06-01
▶
Ubuntu
libxml2 vulnerabilities↗2017-03-16
▶
Red Hat
libxml2: Use after free via namespace node in XPointer ranges↗2016-10-12
▶
Apple
CVE-2016-4658: macOS Sierra 10.12↗2016-09-20
▶
Apple
CVE-2016-4658: iOS 10↗2016-09-13
▶

💬Community

4
Bugzilla
CVE-2016-4658 mingw-libxml2: libxml2: Use after free via namespace node in XPointer ranges [epel-7]↗2016-10-13
▶
Bugzilla
CVE-2016-4658 libxml2: Use after free via namespace node in XPointer ranges↗2016-10-13
▶
Bugzilla
CVE-2016-4658 libxml2: Use after free via namespace node in XPointer ranges [fedora-all]↗2016-10-13
▶
Bugzilla
CVE-2016-4658 mingw-libxml2: libxml2: Use after free via namespace node in XPointer ranges [fedora-all]↗2016-10-13
▶
CVE-2016-4658 (CRITICAL CVSS 9.8) | xpointer.c in libxml2 before 2.9.5 | cvebase.io