CVE-2016-1835: Buffer Overflow
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a Heap use-after-free in xmlSAX2AttributeNs.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759020
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=38eae571111db3b43ffdeb05487c9f60551906fb
Other sources
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1835?
CVE-2016-1835 has been classified as a high severity vulnerability due to the potential for application crashes.
How do I fix CVE-2016-1835?
To mitigate CVE-2016-1835, update the libxml2 library to a version that is not vulnerable, such as 2.9.4+dfsg1-7+deb10u4 or later.
What systems are affected by CVE-2016-1835?
CVE-2016-1835 affects various versions of libxml2 on Debian, Ubuntu, and macOS systems.
What type of vulnerability is CVE-2016-1835?
CVE-2016-1835 is a heap use-after-free vulnerability that can lead to application crashes when processing malicious files.
When was CVE-2016-1835 disclosed?
CVE-2016-1835 was disclosed in May 2016 and has been addressed in subsequent library updates.