CVE Feed

    Dashboard / CVE / CVE-2016-4448

    CVE-2016-4448

    Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

    Published:May 23, 2016
    Last Modified:Apr 12, 2025
    EPS:Jun 9, 2016
    EPSS Score:0.01612
    CVSS Score:9.8

    Affected Products

    Vendor
    Apple
    Product
    Icloud
    Vendor
    Apple
    Product
    Iphone Os
    Vendor
    Apple
    Product
    Itunes
    Vendor
    Apple
    Product
    Mac Os X
    Vendor
    Apple
    Product
    Tvos
    Vendor
    Apple
    Product
    Watchos
    Vendor
    Hp
    Product
    Icewall Federation Agent
    Vendor
    Mcafee
    Product
    Web Gateway
    Vendor
    Microsoft
    Product
    Windows
    Vendor
    Oracle
    Product
    Linux
    Vendor
    Oracle
    Product
    Vm Server
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Enterprise Linux Desktop
    Vendor
    Redhat
    Product
    Enterprise Linux Server
    Vendor
    Redhat
    Product
    Enterprise Linux Server Aus
    Vendor
    Redhat
    Product
    Enterprise Linux Server Eus
    Vendor
    Redhat
    Product
    Enterprise Linux Server Tus
    Vendor
    Redhat
    Product
    Enterprise Linux Workstation
    Vendor
    Redhat
    Product
    Jboss Core Services
    Vendor
    Slackware
    Product
    Slackware Linux
    Vendor
    Tenable
    Product
    Log Correlation Engine
    Vendor
    Xmlsoft
    Product
    Libxml2

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-135 Format String Injection
    CAPEC-67 String Format Overflow in syslog()

    Related CVEs

    CVE-2022-46693 (CVSS 7.8) — An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, i…
    CVE-2022-46698 (CVSS 6.5) — A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Wi…
    CVE-2022-46692 (CVSS 5.5) — A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCl…
    CVE-2020-36521 (CVSS 7.1) — An out-of-bounds read was addressed with improved input validation. This issue is fixed in iCloud for Windows …
    CVE-2018-4302 (CVSS 7.8) — A null pointer dereference was addressed with improved validation. This issue is fixed in macOS High Sierra 10…
    CVE-2021-1811 (CVSS 6.5) — A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.11.3 for Windows,…
    CVE-2021-1857 (CVSS 6.5) — A memory initialization issue was addressed with improved memory handling. This issue is fixed in iTunes 12.11…
    CVE-2021-30928 (CVSS 7.8) — A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 1…
    CVE-2021-1825 (CVSS 6.1) — An input validation issue was addressed with improved input validation. This issue is fixed in iTunes 12.11.3 …
    CVE-2020-29619 (CVSS 7.8) — An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 14.3, macOS Bi…

    References

    http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
    http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
    http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
    http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
    http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
    http://rhn.redhat.com/errata/RHSA-2016-2957.html
    http://www.openwall.com/lists/oss-security/2016/05/25/2
    http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
    http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
    http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
    http://www.securityfocus.com/bid/90856
    http://www.securitytracker.com/id/1036348
    http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
    http://xmlsoft.org/news.html
    https://access.redhat.com/errata/RHSA-2016:1292
    https://bugzilla.redhat.com/show_bug.cgi?id=1338700
    https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9
    https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709
    https://kc.mcafee.com/corporate/index?page=content&id=SB10170
    https://support.apple.com/HT206899
    https://support.apple.com/HT206901
    https://support.apple.com/HT206902
    https://support.apple.com/HT206903
    https://support.apple.com/HT206904
    https://support.apple.com/HT206905
    https://www.tenable.com/security/tns-2016-18
    http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
    http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
    http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
    http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
    http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
    http://rhn.redhat.com/errata/RHSA-2016-2957.html
    http://www.openwall.com/lists/oss-security/2016/05/25/2
    http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
    http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
    http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
    http://www.securityfocus.com/bid/90856
    http://www.securitytracker.com/id/1036348
    http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
    http://xmlsoft.org/news.html
    https://access.redhat.com/errata/RHSA-2016:1292
    https://bugzilla.redhat.com/show_bug.cgi?id=1338700
    https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9
    https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
    https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709
    https://kc.mcafee.com/corporate/index?page=content&id=SB10170
    https://support.apple.com/HT206899
    https://support.apple.com/HT206901
    https://support.apple.com/HT206902
    https://support.apple.com/HT206903
    https://support.apple.com/HT206904
    https://support.apple.com/HT206905
    https://www.tenable.com/security/tns-2016-18

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High