EXPOSURES › CVE-2016-4658
CVE-2016-4658
CRITICAL
DETAIL
SourceNVD · cve
Published2016-09-25
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2016-4658 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
DESCRIPTION
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
SENTIMENT · TRUSTED SOURCES
synthesis
severe-fallout
-0.60
Apple faced severe fallout due to a critical remote code execution vulnerability in iOS and macOS, though the response was relatively swift.
Critical vulnerability in Apple's iOS and macOS led to severe fallout, though the patch was relatively quick.
"CVE-2016-4658: xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document."
No usable coverage; source returned an error and provided no information on the vulnerability or Apple's response.
AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.