CVE-2016-4658Critical· 9.8▾ Midnightxpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 1.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
8.6%
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
iphone_os < 10.0mac_os_x < 10.12tvos < 10.0watchos < 3.0libxml2 < 2.9.5Upgrade past the affected range:
iphone_os 10.0mac_os_x 10.12tvos 10.0watchos 3.0libxml2 2.9.5Connected by shared product, vendor, weakness, or advisory.
CVE-2017-7376Critical· 9.8Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
CVE-2017-7375Critical· 9.8A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes)
CVE-2017-9048High· 7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow
CVE-2017-16931Critical· 9.8parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
CVE-2017-9047High· 7.5A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801
CVE-2021-3541Medium· 6.5A flaw was found in libxml2