This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-4658 →

DEBIAN-CVE-2016-4658

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does...

Original description

The description as published by the source.

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libxml2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-2.1"}]}]

Debian:13 libxml2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-2.1"}]}]

Debian:14 libxml2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-2.1"}]}]

References

advisory security-tracker.debian.org