Vulnerability Details : CVE-2016-1837
Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2016-1837
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
- cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*
- cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*
- cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Threat overview for CVE-2016-1837
Top countries where our scanners detected CVE-2016-1837
Top open port discovered on systems with this issue
548
IPs affected by CVE-2016-1837 818
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2016-1837!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2016-1837
0.47%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-1837
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST | |
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2016-1837
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-1837
-
http://xmlsoft.org/news.html
ReleasesRelease Notes;Vendor Advisory
-
http://www.securitytracker.com/id/1035890
Apple iOS Multiple Flaws Let Remote Users Execute Arbitrary Code and Deny Service and Let Remote and Local Users Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
Oracle Solaris Bulletin - July 2016Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2016:1292
RHSA-2016:1292 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2016-2957.html
RHSA-2016:2957 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2994-1
USN-2994-1: libxml2 vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://lists.apple.com/archives/security-announce/2016/May/msg00001.html
Apple - Lists.apple.comMailing List;Vendor Advisory
-
http://lists.apple.com/archives/security-announce/2016/May/msg00002.html
Apple - Lists.apple.comMailing List;Vendor Advisory
-
https://git.gnome.org/browse/libxml2/commit/?id=11ed4a7a90d5ce156a18980a4ad4e53e77384852
Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (11ed4a7a) · Commits · GNOME / libxml2 · GitLabPatch;Third Party Advisory
-
http://www.securityfocus.com/bid/90691
Apple Mac OS X/watchOS/iOS/tvOS Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
-
https://www.tenable.com/security/tns-2016-18
[R7] LCE 4.8.1 Fixes Multiple Vulnerabilities - Security Advisory | Tenable®Third Party Advisory
-
https://www.debian.org/security/2016/dsa-3593
Debian -- Security Information -- DSA-3593-1 libxml2Third Party Advisory
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10170
McAfee Security Bulletin: McAfee Web Gateway update fixes several vulnerabilities related to xml parsingPatch;Third Party Advisory
-
http://lists.apple.com/archives/security-announce/2016/May/msg00004.html
Apple - Lists.apple.comMailing List;Vendor Advisory
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016Third Party Advisory
-
http://lists.apple.com/archives/security-announce/2016/May/msg00003.html
Apple - Lists.apple.comMailing List;Vendor Advisory
-
https://bugzilla.gnome.org/show_bug.cgi?id=760263
Bug 760263 – Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemLiteralExploit;Issue Tracking;Third Party Advisory
-
https://support.apple.com/HT206568
About the security content of iOS 9.3.2 - Apple SupportVendor Advisory
-
https://support.apple.com/HT206567
About the security content of OS X El Capitan v10.11.5 and Security Update 2016-003 - Apple SupportVendor Advisory
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Oracle Linux Bulletin - July 2016Third Party Advisory
-
https://support.apple.com/HT206566
About the security content of watchOS 2.2.1 - Apple SupportVendor Advisory
-
https://support.apple.com/HT206564
About the security content of tvOS 9.2.1 - Apple SupportVendor Advisory
Jump to