⌘ + K

UBUNTU-CVE-2016-1837

Dashboard / Vulnerabilities / UBUNTU-CVE-2016-1837

UBUNTU-CVE-2016-1837

Published: 20 May 2016Last Modified: 22 Apr 2026

Upstream:

CVE-2016-1837

Aliases:

USN-2994-1

Summary:

Details: Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.

References: https://ubuntu.com/security/CVE-2016-1837, https://support.apple.com/HT206564, https://support.apple.com/HT206566, https://support.apple.com/HT206567, https://support.apple.com/HT206568, http://lists.apple.com/archives/security-announce/2016/May/msg00001.html, http://lists.apple.com/archives/security-announce/2016/May/msg00002.html, http://lists.apple.com/archives/security-announce/2016/May/msg00003.html, http://lists.apple.com/archives/security-announce/2016/May/msg00004.html, https://ubuntu.com/security/notices/USN-2994-1, https://www.cve.org/CVERecord?id=CVE-2016-1837

Affected packages

Package

Name: libxml2

Purl: pkg:deb/ubuntu/[email protected]+dfsg1-3ubuntu4.8?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -2.9.1+dfsg1-3ubuntu4.8

Affected versions

2.9.1+dfsg1-3ubuntu2

2.9.1+dfsg1-3ubuntu3

2.9.1+dfsg1-3ubuntu4

2.9.1+dfsg1-3ubuntu4.1

2.9.1+dfsg1-3ubuntu4.2

2.9.1+dfsg1-3ubuntu4.3

2.9.1+dfsg1-3ubuntu4.4

2.9.1+dfsg1-3ubuntu4.5

2.9.1+dfsg1-3ubuntu4.6

2.9.1+dfsg1-3ubuntu4.7

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High