CVE-2016-4447

Published: Jun 9, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.

Affected (17)

Products: Hp: Icewall Federation Agent · Canonical: Ubuntu Linux · Debian: Debian Linux · +4 more

Show all products

Hp: Icewall Federation Agent · Canonical: Ubuntu Linux · Debian: Debian Linux · Oracle: Vm Server · Apple: Itunes, Iphone Os, Mac Os X, Tvos, Watchos · Xmlsoft: Libxml2 · Mcafee: Web Gateway

1 product

Icewall Federation Agent

1 product

1 product

1 product

5 products

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hp Icewall Federation Agent	Version 3.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Vm Server	Version 3.3
Oracle Vm Server	Version 3.4

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Apple Itunes	Version 12.4.1

Running on/with	Platform Versions
Microsoft Windows	All versions

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Up to 9.3.2
Apple Mac Os X	Up to 10.11.5
Apple Tvos	Up to 9.2.1
Apple Watchos	Up to 2.2.1

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml2	Up to 2.9.3

Configuration H

2 vulnerable

Vulnerable Software	Affected Versions
Mcafee Web Gateway	From 7.5.0.0 to 7.5.2.10
Mcafee Web Gateway	From 7.6.0.0 to 7.6.2.3

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (54)

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html

Source: secalert@redhat.com

Mailing ListNot Applicable

http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/05/25/2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/90864

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1036348

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722

Source: secalert@redhat.com

ExploitMailing ListThird Party Advisory

http://www.ubuntu.com/usn/USN-2994-1

Source: secalert@redhat.com

Third Party Advisory

http://xmlsoft.org/news.html

Source: secalert@redhat.com

Release NotesVendor Advisory

https://access.redhat.com/errata/RHSA-2016:1292

Source: secalert@redhat.com

Third Party Advisory

https://git.gnome.org/browse/libxml2/commit/?id=00906759053986b8079985644172085f74331f83

Source: secalert@redhat.com

PatchThird Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10170

Source: secalert@redhat.com

PatchThird Party Advisory

https://support.apple.com/HT206899

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/HT206901

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/HT206902

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/HT206903

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/HT206904

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/HT206905

Source: secalert@redhat.com

Third Party Advisory

https://www.debian.org/security/2016/dsa-3593

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-18

Source: secalert@redhat.com

Third Party Advisory

http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html