Back to search
CVE-2016-4658
Published: Sep 25, 2016
Modified: Aug 6, 2024
PUBLISHED
Description
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
https://support.apple.com/HT207141
x_refsource_CONFIRM
1036858
vdb-entry
x_refsource_SECTRACK
APPLE-SA-2016-09-20
vendor-advisory
x_refsource_APPLE
APPLE-SA-2016-09-20-3
vendor-advisory
x_refsource_APPLE
APPLE-SA-2016-09-20-5
vendor-advisory
x_refsource_APPLE
APPLE-SA-2016-09-20-6
vendor-advisory
x_refsource_APPLE
93054
vdb-entry
x_refsource_BID
https://support.apple.com/HT207170
x_refsource_CONFIRM
GLSA-201701-37
vendor-advisory
x_refsource_GENTOO
https://support.apple.com/HT207142
x_refsource_CONFIRM
https://support.apple.com/HT207143
x_refsource_CONFIRM
1038623
vdb-entry
x_refsource_SECTRACK
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now