CVE-2016-4447: Buffer Overflow
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based buffer underread in xmlParseName.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759573
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=00906759053986b8079985644172085f74331f83
Other sources
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4447?
CVE-2016-4447 is classified as a high severity vulnerability due to the potential for application crashes.
How do I fix CVE-2016-4447?
To fix CVE-2016-4447, upgrade your libxml2 library to versions 2.9.4+dfsg1-7+deb10u4 or newer, depending on your operating system.
What applications are affected by CVE-2016-4447?
CVE-2016-4447 affects various applications that utilize the libxml2 library, including Debian and Ubuntu systems.
What type of vulnerability is CVE-2016-4447?
CVE-2016-4447 is a heap-based buffer underread vulnerability that can lead to application instability.
Is there a workaround for CVE-2016-4447?
There are no specific workarounds for CVE-2016-4447; upgrading to a patched version is recommended.