CVE-2016-1762: Buffer Overflow
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlNextChar.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759671
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=a7a94612aa3b16779e2c74e1fa353b5d9786c602
Other sources
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1762?
CVE-2016-1762 is considered a moderate severity vulnerability due to the potential for heap-based buffer overreads.
How do I fix CVE-2016-1762?
To fix CVE-2016-1762, update the libxml2 library to a version that is patched, such as 2.9.4+dfsg1-7+deb10u4 or later.
Which software versions are affected by CVE-2016-1762?
Affected software versions include certain versions of libxml2, Apple Safari, iOS, macOS, tvOS, and several versions of Red Hat and Ubuntu Linux.
Is CVE-2016-1762 exploitable remotely?
Yes, CVE-2016-1762 can be exploited remotely if the application utilizing the libxml2 library processes untrusted XML data.
What type of attack does CVE-2016-1762 facilitate?
CVE-2016-1762 facilitates potential attacks that may result in information disclosure or application crashes through buffer overreads.