Vulnerability Details : CVE-2016-1835
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2016-1835
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-1835
1.24%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 78 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-1835
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2016-1835
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-1835
-
http://xmlsoft.org/news.html
Releases
-
http://www.securitytracker.com/id/1035890
Apple iOS Multiple Flaws Let Remote Users Execute Arbitrary Code and Deny Service and Let Remote and Local Users Obtain Potentially Sensitive Information - SecurityTracker
-
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
Oracle Solaris Bulletin - July 2016
-
https://access.redhat.com/errata/RHSA-2016:1292
RHSA-2016:1292 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2016-2957.html
RHSA-2016:2957 - Security Advisory - Red Hat Customer Portal
-
http://www.securityfocus.com/bid/90696
Apple Mac OS X APPLE-SA-2016-05-16-4 Multiple Security Vulnerabilities
-
http://www.ubuntu.com/usn/USN-2994-1
USN-2994-1: libxml2 vulnerabilities | Ubuntu security notices
-
https://bugzilla.gnome.org/show_bug.cgi?id=759020
Bug 759020 – Heap use-after-free in xmlSAX2AttributeNs
-
http://lists.apple.com/archives/security-announce/2016/May/msg00002.html
Apple - Lists.apple.comVendor Advisory
-
https://www.tenable.com/security/tns-2016-18
[R7] LCE 4.8.1 Fixes Multiple Vulnerabilities - Security Advisory | Tenable®
-
https://www.debian.org/security/2016/dsa-3593
Debian -- Security Information -- DSA-3593-1 libxml2
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10170
McAfee Security Bulletin: McAfee Web Gateway update fixes several vulnerabilities related to xml parsing
-
http://lists.apple.com/archives/security-announce/2016/May/msg00004.html
Apple - Lists.apple.comVendor Advisory
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016
-
https://support.apple.com/HT206568
About the security content of iOS 9.3.2 - Apple SupportVendor Advisory
-
https://git.gnome.org/browse/libxml2/commit/?id=38eae571111db3b43ffdeb05487c9f60551906fb
Heap use-after-free in xmlSAX2AttributeNs (38eae571) · Commits · GNOME / libxml2 · GitLab
-
https://support.apple.com/HT206567
About the security content of OS X El Capitan v10.11.5 and Security Update 2016-003 - Apple SupportVendor Advisory
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Oracle Linux Bulletin - July 2016
Jump to