⌘ + K

UBUNTU-CVE-2016-1834

Dashboard / Vulnerabilities / UBUNTU-CVE-2016-1834

UBUNTU-CVE-2016-1834

Published: 20 May 2016Last Modified: 22 Apr 2026

Upstream:

CVE-2016-1834

Aliases:

USN-2994-1

Summary:

Details: Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

References: https://ubuntu.com/security/CVE-2016-1834, https://support.apple.com/HT206564, https://support.apple.com/HT206566, https://support.apple.com/HT206567, https://support.apple.com/HT206568, http://lists.apple.com/archives/security-announce/2016/May/msg00001.html, http://lists.apple.com/archives/security-announce/2016/May/msg00002.html, http://lists.apple.com/archives/security-announce/2016/May/msg00003.html, http://lists.apple.com/archives/security-announce/2016/May/msg00004.html, https://ubuntu.com/security/notices/USN-2994-1, https://www.cve.org/CVERecord?id=CVE-2016-1834

Affected packages

Package

Name: libxml2

Purl: pkg:deb/ubuntu/[email protected]+dfsg1-3ubuntu4.8?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -2.9.1+dfsg1-3ubuntu4.8

Affected versions

2.9.1+dfsg1-3ubuntu2

2.9.1+dfsg1-3ubuntu3

2.9.1+dfsg1-3ubuntu4

2.9.1+dfsg1-3ubuntu4.1

2.9.1+dfsg1-3ubuntu4.2

2.9.1+dfsg1-3ubuntu4.3

2.9.1+dfsg1-3ubuntu4.4

2.9.1+dfsg1-3ubuntu4.5

2.9.1+dfsg1-3ubuntu4.6

2.9.1+dfsg1-3ubuntu4.7

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High