Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

libxml2 before 2.9.4 can crash from malicious XML

CVE-2016-1835 · published 10 years ago
Summary

The libxml2 library version earlier than 2.9.4, used in Debian and older Apple iOS and macOS releases, can be forced to stop working when it processes a specially crafted XML file. This could make a web service or app unavailable to users. Update libxml2 to version 2.9.4 or later to prevent the crash.

What to do
  • Update debian libxml2 to version 2.9.3+dfsg1-1.1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian libxml2 < 2.9.3+dfsg1-1.1
Fix: upgrade to 2.9.3+dfsg1-1.1
Debian:13 debian libxml2 < 2.9.3+dfsg1-1.1
Fix: upgrade to 2.9.3+dfsg1-1.1
Debian:14 debian libxml2 < 2.9.3+dfsg1-1.1
Fix: upgrade to 2.9.3+dfsg1-1.1
– canonical ubuntu_linux 12.04
14.04
15.10
16.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
– apple iphone_os <= 9.3.1
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
– apple mac_os_x <= 10.11.4
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
– debian debian_linux 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Original advisory text
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of serv...
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.
References
Severity
8.8 High
Exploitation
6% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published20 May 2016
Updated31 Oct 2026
First seen22 Sep 2026
Sources
DEBIAN-CVE-2016-1835 · OSV
CVE-2016-1835 · NVD
Track software like this
Free during beta