CVE-2016-1834

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

Affected products

Alt Linux, Centos, Os X, Red Hat, Suse, Ubuntu, Ios, Libxml2

Canonical Ubuntu Linux

= 12.04, 14.04, 15.10, 16.04

Fix

Available

CVSS 2.0

9.3 HIGH

CVSS 3.1

7.8 HIGH

EPSS

4.6% (91th percentile)

Weakness

CWE-119, CWE-122

NVD status

Modified

Published

2016-05-20

No exploit for CVE-2016-1834 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.