CVE-2016-9598

CWE-125 — Out-of-bounds Read CWE-674 — Uncontrolled Recursion6 documents6 sources

Severity

6.5MEDIUM

EPSS

0.7%

top 28.61%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Xmlsoft Libxml2

Timeline

PublishedAug 16

Latest updateMay 13

Description

libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDxmlsoft/libxml2< 2.9.4

🔴Vulnerability Details

GHSA

GHSA-8gff-r69h-5xgv: libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application c↗2022-05-13

▶

CVEList

CVE-2016-9598: libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application c↗2018-08-16

▶

📋Vendor Advisories

Red Hat

libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS)↗2016-05-03

▶

Debian

CVE-2016-9598: libxml2 - libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attack...↗2016

▶

💬Community

Bugzilla

CVE-2016-9598 libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS)↗2016-12-22

▶