CVE-2016-1839: Medium severity iphone os vulnerability
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlDictAddString.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758605
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=a820dbeac29d330bae4be05d9ecd939ad6b4aa33
Other sources
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1839?
CVE-2016-1839 has been rated as a high severity vulnerability due to its potential for triggering a heap-based buffer overread.
How do I fix CVE-2016-1839?
To fix CVE-2016-1839, update the libxml2 library to version 2.9.4+dfsg1-7+deb10u4 or higher.
What software is affected by CVE-2016-1839?
CVE-2016-1839 affects multiple software including libxml2 versions before 2.9.4, as well as various operating systems like Debian, Ubuntu, and Red Hat.
Can CVE-2016-1839 be exploited remotely?
Yes, CVE-2016-1839 could potentially be exploited remotely if an application uses the vulnerable version of libxml2 for untrusted input processing.
Is there a known exploit for CVE-2016-1839?
While there are no public exploits reported for CVE-2016-1839, the nature of the vulnerability presents a risk of exploitation.