CVE-2016-4658

תיאור (מקור, אנגלית)

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

מדדים

EPSS — סבירות ניצול

9% (אחוזון 100) נכון ל-14/10/2026

CWE

CWE-119

מוצרים מושפעים

apple: iphone os; apple: mac os x; apple: tvos; apple: watchos; xmlsoft: libxml2

קישורים

• http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html Mailing ListVendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html Mailing ListVendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html Mailing ListVendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html Mailing ListVendor Advisory
• https://support.apple.com/HT207141 Vendor Advisory
• https://support.apple.com/HT207142 Vendor Advisory
• https://support.apple.com/HT207143 Vendor Advisory
• https://support.apple.com/HT207170 Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html Mailing ListVendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html Mailing ListVendor Advisory