Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-4616: Apple iOS, macOS, tvOS, watchOS, iTunes, iCloud may crash

CVE-2016-4616 · published 10 years ago

Summary

Older versions of Apple's iOS, macOS, tvOS, watchOS, iTunes for Windows, and iCloud for Windows contain a flaw that lets a remote user trigger a crash and possibly other effects. The problem stems from how the libxml2 component processes data, leading to corrupted memory. Update each product to the latest version released by Apple to remove the risk.

What to do

Update apple iphone_os to version 9.3.3 or later.
Update apple mac_os_x to version 10.11.6 or later.
Update apple tvos to version 9.2.2 or later.
Update apple watchos to version 2.2.2 or later.
Update apple icloud to version 5.2.1 or later.
Update apple itunes to version 12.4.2 or later.

Affected software

Vendor	Product	Affected versions
apple	iphone_os	< 9.3.3 `cpe:2.3:o:apple:iphone_os::::::::`
apple	mac_os_x	< 10.11.6 `cpe:2.3:o:apple:mac_os_x::::::::`
apple	tvos	< 9.2.2 `cpe:2.3:o:apple:tvos::::::::`
apple	watchos	< 2.2.2 `cpe:2.3:o:apple:watchos::::::::`
apple	icloud	< 5.2.1 `cpe:2.3:a:apple:icloud::::::::`
apple	itunes	< 12.4.2 `cpe:2.3:a:apple:itunes::::::::`

Original advisory text

libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4614, CVE-2016-4615, and CVE-2016-4619.

References

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html Mailing List Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html Mailing List Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html Mailing List Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html Mailing List Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html Mailing List Vendor Advisory
http://www.securityfocus.com/bid/91826 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036348 Third Party Advisory VDB Entry
https://support.apple.com/HT206899 Vendor Advisory
https://support.apple.com/HT206901 Vendor Advisory
https://support.apple.com/HT206902 Vendor Advisory
https://support.apple.com/HT206903 Vendor Advisory
https://support.apple.com/HT206904 Vendor Advisory
https://support.apple.com/HT206905 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

3% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published22 Jul 2016

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2016-4616 · NVD

Track software like this

Free during beta