NetSight
IP …
medium5.5Public exploit code

CVE-2016-1839

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, all…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

Affected products

VendorProductAffected versions
AppleIphone Os
before 9.3.2
AppleMac Os X
before 10.11.5
AppleTvos
before 9.2.1
AppleWatchos
before 2.2.1
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.10, 16.04
DebianDebian Linux
Version 8.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4, 7.6
RedhatEnterprise Linux Server Eus
Versions 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux Server Tus
Versions 7.2, 7.3, 7.6
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0

Weakness classification

CWE-125

References