ISOMAN

CVE

CVE-2016-1840

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

Severity
HIGH
CVSS
7.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://lists.apple.com/archives/security-announce/2016/May/msg00001.html
  2. http://lists.apple.com/archives/security-announce/2016/May/msg00002.html
  3. http://lists.apple.com/archives/security-announce/2016/May/msg00003.html
  4. http://lists.apple.com/archives/security-announce/2016/May/msg00004.html
  5. http://rhn.redhat.com/errata/RHSA-2016-2957.html
  6. http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
  7. http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
  8. http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
  9. http://www.securityfocus.com/bid/90691
  10. http://www.securitytracker.com/id/1035890
  11. http://www.ubuntu.com/usn/USN-2994-1
  12. http://xmlsoft.org/news.html
  13. https://access.redhat.com/errata/RHSA-2016:1292
  14. https://bugzilla.gnome.org/show_bug.cgi?id=757711
  15. https://git.gnome.org/browse/libxml2/commit/?id=cbb271655cadeb8dbb258a64701d9a3a0c4835b4
  16. https://kc.mcafee.com/corporate/index?page=content&id=SB10170
  17. https://security.gentoo.org/glsa/201701-37
  18. https://support.apple.com/HT206564
  19. https://support.apple.com/HT206566
  20. https://support.apple.com/HT206567