CVE-2016-1833: Medium severity iphone os vulnerability
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based out-of-bounds memory read.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758606
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=0bcd05c5cd83dec3406c8f68b769b1d610c72f76
Other sources
The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1833?
CVE-2016-1833 has been classified as a moderate severity vulnerability due to potential crashes caused by heap-based out-of-bounds memory reads.
How do I fix CVE-2016-1833?
To fix CVE-2016-1833, upgrade libxml2 to version 2.9.4+dfsg1-7+deb10u4 or higher based on your operating system.
Which software versions are affected by CVE-2016-1833?
CVE-2016-1833 affects various software versions including libxml2 before 2.9.5, and it targets several operating systems including Debian, Ubuntu, and macOS.
Can CVE-2016-1833 be exploited remotely?
Yes, CVE-2016-1833 can be exploited remotely if a user interacts with a maliciously crafted XML file.
What type of attack can CVE-2016-1833 facilitate?
CVE-2016-1833 can facilitate denial of service attacks by causing applications to crash.