CVE-2016-4448
libxml2: Format string vulnerability
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Amazon (high), Oracle (high), Red Hat (medium), Ubuntu (low).
Description
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | libxml2, libxml2-debuginfo, libxml2-devel and 3 more | 2.9.1-6.3.49.amzn1 |
| debian 11 | libxml2 | 2.9.4+dfsg1-1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-1 |
| debian 7 | libxml2 | no fix listed |
| debian 8 | libxml2 | no fix listed |
| echo | libxml2, libxml2-2.9.1 | 2.9.4+dfsg1-1 and 1 more |
| Oracle Linux 6 | libxml2, libxml2-devel, libxml2-python and 1 more | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 7 | libxml2, libxml2-devel, libxml2-python and 1 more | 2.9.1-6.0.1.el7_2.3 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-1 |
Show all 32 entries from 19 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | libxml2 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-debuginfo | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-devel | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-python26 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-python27 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-static | 2.9.1-6.3.49.amzn1 |
| debian 11 | libxml2 | 2.9.4+dfsg1-1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-1 |
| debian 7 | libxml2 | no fix listed |
| debian 8 | libxml2 | no fix listed |
| echo | libxml2 | 2.9.4+dfsg1-1 |
| echo | libxml2-2.9.1 | 2.9.1+e1 |
| Oracle Linux 6 | libxml2 | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-devel | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-python | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-static | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 7 | libxml2 | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-devel | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-python | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-static | 2.9.1-6.0.1.el7_2.3 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| seal Red Hat 6 | libxml2 | 2.7.6-21.el6_8.1+sp999 |
| seal Red Hat 6 | seal-libxml2 | 2.7.6-21.el6_8.1+sp999 |
| ubuntu 12.04 | libxml2 | 2.7.8.dfsg-5.1ubuntu4.17 |
| ubuntu 14.04 | libxml2 | 2.9.1+dfsg1-3ubuntu4.9 |
| ubuntu 14.04-ESM | libxml2 | 2.9.1+dfsg1-3ubuntu4.9 |
| ubuntu 16.04 | libxml2 | 2.9.3+dfsg1-1ubuntu0.2 |
| ubuntu 16.04-ESM | libxml2 | 2.9.3+dfsg1-1ubuntu0.2 |
References
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://www.openwall.com/lists/oss-security/2016/05/25/2
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
All 33 references
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/90856
- http://www.securitytracker.com/id/1036348
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
- http://xmlsoft.org/news.html
- https://access.redhat.com/errata/RHSA-2016:1292
- https://access.redhat.com/security/cve/CVE-2016-4448
- https://bugzilla.redhat.com/show_bug.cgi?id=1338700
- https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9
- https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709
- https://kc.mcafee.com/corporate/index?page=content&id=SB10170
- https://linux.oracle.com/cve/CVE-2016-4448.html
- https://linux.oracle.com/errata/ELSA-2016-1292.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-4448
- https://support.apple.com/HT206899
- https://support.apple.com/HT206901
- https://support.apple.com/HT206902
- https://support.apple.com/HT206903
- https://support.apple.com/HT206904
- https://support.apple.com/HT206905
- https://ubuntu.com/security/notices/USN-3235-1
- https://www.cve.org/CVERecord?id=CVE-2016-4448
- https://www.tenable.com/security/tns-2016-18