CVE-2016-1835

EPSS 5.58%
Veröffentlicht 20.05.2016 10:59:49
Zuletzt bearbeitet 06.05.2026 22:30:45
Erkennungen
Login

Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 21

NVD 7 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Canonical ≫ Ubuntu Linux Version 12.04 SwEdition lts

Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts

Canonical ≫ Ubuntu Linux Version 15.10

Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts

Apple ≫ iPhone OS Version <= 9.3.1

Apple ≫ macOS X Version <= 10.11.4

Debian ≫ Debian Linux Version 8.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	5.58%	0.922

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.8	2.8	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://xmlsoft.org/news.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://rhn.redhat.com/errata/RHSA-2016-2957.html

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

https://www.tenable.com/security/tns-2016-18

http://www.ubuntu.com/usn/USN-2994-1

https://www.debian.org/security/2016/dsa-3593

https://access.redhat.com/errata/RHSA-2016:1292

https://kc.mcafee.com/corporate/index?page=content&id=SB10170

http://lists.apple.com/archives/security-announce/2016/May/msg00004.html

Vendor Advisory

https://support.apple.com/HT206567

Vendor Advisory

http://lists.apple.com/archives/security-announce/2016/May/msg00002.html

Vendor Advisory

http://www.securitytracker.com/id/1035890

https://support.apple.com/HT206568

Vendor Advisory

http://www.securityfocus.com/bid/90696

https://bugzilla.gnome.org/show_bug.cgi?id=759020

https://git.gnome.org/browse/libxml2/commit/?id=38eae571111db3b43ffdeb05487c9f60551906fb

https://nvd.nist.gov/vuln/detail/CVE-2016-1835

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-1835

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-1835

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2016-1835