CVE-2016-4448

Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
Affected Products (NVD)
VendorProductVersion
hpicewall_federation_agent
3.0
applewatchos
𝑥
≤ 2.2.1
applemac_os_x
𝑥
< 10.11.6
xmlsoftlibxml2
𝑥
≤ 2.9.3
appleicloud
𝑥
< 5.2.1
appleiphone_os
𝑥
≤ 9.3.2
redhatenterprise_linux_desktop
6.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
6.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.2
redhatenterprise_linux_server_aus
7.3
redhatenterprise_linux_server_aus
7.4
redhatenterprise_linux_server_aus
7.6
redhatenterprise_linux_server_aus
7.7
redhatenterprise_linux_server_eus
7.2
redhatenterprise_linux_server_eus
7.3
redhatenterprise_linux_server_eus
7.4
redhatenterprise_linux_server_eus
7.5
redhatenterprise_linux_server_eus
7.6
redhatenterprise_linux_server_eus
7.7
redhatenterprise_linux_server_tus
7.2
redhatenterprise_linux_server_tus
7.3
redhatenterprise_linux_server_tus
7.6
redhatenterprise_linux_server_tus
7.7
redhatenterprise_linux_workstation
6.0
redhatenterprise_linux_workstation
7.0
appleitunes
𝑥
≤ 12.4.1
slackwareslackware_linux
14.0
slackwareslackware_linux
14.1
oraclevm_server
3.3
oraclevm_server
3.4
appletvos
𝑥
≤ 9.2.1
tenablelog_correlation_engine
4.8.0
mcafeeweb_gateway
𝑥
≤ 7.5.2.10
mcafeeweb_gateway
7.6.0.0 ≤
𝑥
≤ 7.6.2.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libxml2
bookworm
2.9.14+dfsg-1.3~deb12u1
fixed
bullseye
2.9.10+dfsg-6.7+deb11u4
fixed
bullseye (security)
2.9.10+dfsg-6.7+deb11u5
fixed
jessie
ignored
sid
2.12.7+dfsg+really2.9.14-0.1
fixed
trixie
2.12.7+dfsg+really2.9.14-0.1
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libxml2
precise
Fixed 2.7.8.dfsg-5.1ubuntu4.17
released
trusty
Fixed 2.9.1+dfsg1-3ubuntu4.9
released
wily
ignored
xenial
Fixed 2.9.3+dfsg1-1ubuntu0.2
released
yakkety
not-affected
zesty
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libxml2-2
suse enterprise sap 12
2.9.1-24.1
fixed
suse enterprise sap 12 SP1
2.9.1-24.1
fixed
suse enterprise server 12
2.9.1-24.1
fixed
suse enterprise server 12 SP1
2.9.1-24.1
fixed
libxml2-2-32bit
suse enterprise sap 12
2.9.1-24.1
fixed
suse enterprise sap 12 SP1
2.9.1-24.1
fixed
suse enterprise server 12
2.9.1-24.1
fixed
suse enterprise server 12 SP1
2.9.1-24.1
fixed
libxml2-doc
suse enterprise sap 12
2.9.1-24.1
fixed
suse enterprise sap 12 SP1
2.9.1-24.1
fixed
suse enterprise server 12
2.9.1-24.1
fixed
suse enterprise server 12 SP1
2.9.1-24.1
fixed
libxml2-tools
suse enterprise sap 12
2.9.1-24.1
fixed
suse enterprise sap 12 SP1
2.9.1-24.1
fixed
suse enterprise server 12
2.9.1-24.1
fixed
suse enterprise server 12 SP1
2.9.1-24.1
fixed
python-libxml2
suse enterprise sap 12
2.9.1-24.1
fixed
suse enterprise sap 12 SP1
2.9.1-24.1
fixed
suse enterprise server 12
2.9.1-24.1
fixed
suse enterprise server 12 SP1
2.9.1-24.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libxml2
RHEL 6
0:2.7.6-21.el6_8.1
fixed
RHEL 7
0:2.9.1-6.el7_2.3
fixed
libxml2-devel
RHEL 6
0:2.7.6-21.el6_8.1
fixed
RHEL 7
0:2.9.1-6.el7_2.3
fixed
libxml2-python
RHEL 6
0:2.7.6-21.el6_8.1
fixed
RHEL 7
0:2.9.1-6.el7_2.3
fixed
libxml2-static
RHEL 6
0:2.7.6-21.el6_8.1
fixed
RHEL 7
0:2.9.1-6.el7_2.3
fixed
Common Weakness Enumeration
References
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
http://rhn.redhat.com/errata/RHSA-2016-2957.html
http://www.openwall.com/lists/oss-security/2016/05/25/2
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/90856
http://www.securitytracker.com/id/1036348
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
http://xmlsoft.org/news.html
https://access.redhat.com/errata/RHSA-2016:1292
https://bugzilla.redhat.com/show_bug.cgi?id=1338700
https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9
https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709
https://kc.mcafee.com/corporate/index?page=content&id=SB10170
https://support.apple.com/HT206899
https://support.apple.com/HT206901
https://support.apple.com/HT206902
https://support.apple.com/HT206903
https://support.apple.com/HT206904
https://support.apple.com/HT206905
https://www.tenable.com/security/tns-2016-18
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
http://rhn.redhat.com/errata/RHSA-2016-2957.html
http://www.openwall.com/lists/oss-security/2016/05/25/2
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/90856
http://www.securitytracker.com/id/1036348
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
http://xmlsoft.org/news.html
https://access.redhat.com/errata/RHSA-2016:1292
https://bugzilla.redhat.com/show_bug.cgi?id=1338700
https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9
https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709
https://kc.mcafee.com/corporate/index?page=content&id=SB10170
https://support.apple.com/HT206899
https://support.apple.com/HT206901
https://support.apple.com/HT206902
https://support.apple.com/HT206903
https://support.apple.com/HT206904
https://support.apple.com/HT206905
https://www.tenable.com/security/tns-2016-18