CVE-2016-4658CWE-119

CVE-2016-4658

Critical · published September 25, 2016

CVSS v3.0
9.8
EPSS
9%
Percentile
95.0
In the wild
Unconfirmed
What it is

⚠️ A sneaky oversight in libxml2 can turn your XML documents into unwelcome party crashers! 🎉 Think of it like a restaurant that doesn't check if everyone on the guest list is actually invited — namespace nodes can sneak in and cause chaos. Just like uninvited guests can disrupt a dinner party, a crafted XML document can lead to remote code execution or memory issues. An attacker could exploit this by sending a malicious XML document, leading to arbitrary code execution or potentially crashing the application! This could compromise user data or bring the whole system to a halt, resulting in a denial of service — absolutely devastating!

Put simply

Think of it like a restaurant that doesn't check if everyone on the guest list is actually invited — namespace nodes can sneak in and cause chaos. Just like uninvited guests can disrupt a dinner party, a crafted XML document can lead to remote code execution or memory issues. This vulnerability exists because xpointer.c in libxml2 fails to properly restrict namespace nodes in XPointer ranges. This oversight allows for use-after-free scenarios and memory corruption in various applications using affected versions of libxml2.

What to do

An attacker could exploit this by sending a malicious XML document, leading to arbitrary code execution or potentially crashing the application! This could compromise user data or bring the whole system to a halt, resulting in a denial of service — absolutely devastating! Upgrade libxml2 to version 2.9.5 or later to close this loophole. As a best practice, audit your XML handling code to ensure it correctly validates and processes documents. Keeping an eye on your dependencies is key! You've got this! With a quick update, you'll bolster your defenses against unwanted intrusions! 🛡️

The record
Technical detail
CVSS v3.0
9.8 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.08559 · 95.0th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2016-09-25T14:59Z
Affected products (5)
ProductVersionsFixed in
apple/iphone_os< 10.010.0
apple/mac_os_x< 10.1210.12
apple/tvos< 10.010.0
apple/watchos< 3.03.0
xmlsoft/libxml2< 2.9.52.9.5
References (27)
http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html · [email protected]http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html · [email protected]http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html · [email protected]http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html · [email protected]http://www.securityfocus.com/bid/93054 · [email protected]http://www.securitytracker.com/id/1036858 · [email protected]http://www.securitytracker.com/id/1038623 · [email protected]https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b · [email protected]https://security.gentoo.org/glsa/201701-37 · [email protected]https://support.apple.com/HT207141 · [email protected]https://support.apple.com/HT207142 · [email protected]https://support.apple.com/HT207143 · [email protected]https://support.apple.com/HT207170 · [email protected]http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html · af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html · af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html · af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/93054 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1036858 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1038623 · af854a3a-2127-422b-91ae-364da2661108https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201701-37 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT207141 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT207142 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT207143 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT207170 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 25 SEP 10:00Z
    xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not…
    cvelistv5