CVE-2016-4658 Nokogiri does not forbid namespace nodes in XPointer ranges
Remote attackers can execute arbitrary code or cause denial of service via crafted XML due to a use-after-free in libxml2.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-4658?
CVE-2016-4658 is a critical use after free vulnerability in Apple Iphone Os, published on 25 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
Weakness: CWE-119
Which versions are affected by CVE-2016-4658?
2 open source packages ship an affected version, including nokogiri. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | All versions | 1.7.1 |
nokogiri RubyGems | All versions | 1.7.1 |
Linux distribution packages (30)
libxml2 Red Hat:enterprise_linux:7::client | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-devel Red Hat:enterprise_linux:7::client | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-python Red Hat:enterprise_linux:7::client | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-static Red Hat:enterprise_linux:7::client | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-static Red Hat:enterprise_linux:7::computenode | All versions | 0:2.9.1-6.el7_9.6 |
libxml2 Red Hat:enterprise_linux:7::server | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-devel Red Hat:enterprise_linux:7::server | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-python Red Hat:enterprise_linux:7::server | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-static Red Hat:enterprise_linux:7::server | All versions | 0:2.9.1-6.el7_9.6 |
libxml2 Red Hat:enterprise_linux:7::workstation | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-python Red Hat:enterprise_linux:7::workstation | All versions | 0:2.9.1-6.el7_9.6 |
libxml2-static Red Hat:enterprise_linux:7::workstation | All versions | 0:2.9.1-6.el7_9.6 |
libxml2 SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 2.9.1-26.3.1 |
python-libxml2 SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 2.9.1-26.3.1 |
libxml2 SUSE:Linux Enterprise Server 11 SP4 | All versions | 2.7.6-0.50.1 |
libxml2-python SUSE:Linux Enterprise Server 11 SP4 | All versions | 2.7.6-0.50.4 |
libxml2 SUSE:Linux Enterprise Server 12 SP1 | All versions | 2.9.1-26.3.1 |
python-libxml2 SUSE:Linux Enterprise Server 12 SP1 | All versions | 2.9.1-26.3.1 |
libxml2 SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 2.7.6-0.50.1 |
libxml2-python SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 2.7.6-0.50.4 |
libxml2 SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 2.9.1-26.3.1 |
python-libxml2 SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 2.9.1-26.3.1 |
libxml2 SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 2.7.6-0.50.1 |
libxml2 SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 2.9.1-26.3.1 |
Products include Apple Iphone Os, Apple Mac Os X, Apple Tvos, Apple Watchos, Xmlsoft Libxml2.
How do I fix CVE-2016-4658?
Upgrade nokogiri to 1.7.1 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2016-4658 being exploited?
There is no known exploitation of CVE-2016-4658 in the wild and no public exploit code.
Other vulnerabilities in Apple Iphone Os
Sources
Also known as CLSA-2023-1699381307, CLSA-2023-1699393971, DEBIAN-CVE-2016-4658, ECHO-f7fb-e3bf-0154, GHSA-fr52-4hqw-p27f, RHSA-2021:3810 and 3 more.