CVE-2016-4658: Buffer Overflow
The libxml2 library, as used in multiple products, could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption error. An attacker could exploit this vulnerability using a specially crafted XML document to execute arbitrary code on the system or cause a denial of service.
Other sources
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-4658?
CVE-2016-4658 is a vulnerability in the libxml2 library that allows a remote attacker to execute arbitrary code or cause a denial of service.
Which products are affected by CVE-2016-4658?
CVE-2016-4658 affects Google Android, Apple iPhone OS (up to version 10.0), Apple Mac OS X (up to version 10.12), Apple tvOS (up to version 10.0), Apple watchOS (up to version 3.0), Xmlsoft Libxml2 (up to version 2.9.5), and IBM Security Guardium (up to version 11.4).
What is the severity of CVE-2016-4658?
CVE-2016-4658 has a severity rating of 9.8 (Critical).
How can CVE-2016-4658 be fixed?
To fix CVE-2016-4658, users should update to a version of the affected software that includes the necessary patches or security updates.
Where can I find more information about CVE-2016-4658?
You can find more information about CVE-2016-4658 on the IBM X-Force Exchange website and the IBM Support website, as well as on the official Android source code repository.