CVE-2016-4658
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 8.56% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- apple/iphone os · apple/mac os x · apple/tvos · apple/watchos · xmlsoft/libxml2
- Source
- product-security@apple.com
References
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.htmlMailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.htmlMailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.htmlMailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.htmlMailing List, Vendor Advisory
- http://www.securityfocus.com/bid/93054Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036858Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038623Third Party Advisory, VDB Entry
- https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344bPatch, Third Party Advisory
- https://security.gentoo.org/glsa/201701-37Third Party Advisory
- https://support.apple.com/HT207141Vendor Advisory
- https://support.apple.com/HT207142Vendor Advisory
- https://support.apple.com/HT207143Vendor Advisory
- https://support.apple.com/HT207170Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.htmlMailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.htmlMailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.htmlMailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.htmlMailing List, Vendor Advisory
- http://www.securityfocus.com/bid/93054Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036858Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038623Third Party Advisory, VDB Entry
- https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344bPatch, Third Party Advisory
- https://security.gentoo.org/glsa/201701-37Third Party Advisory
- https://support.apple.com/HT207141Vendor Advisory
- https://support.apple.com/HT207142Vendor Advisory
- https://support.apple.com/HT207143Vendor Advisory
- https://support.apple.com/HT207170Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.