CVE-2016-4448
CRITICALCVSS 9.8/10EPSS 7.04%
Last modified
CVE-2016-4448 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.. EPSS estimates a 7.04% chance of exploitation in the next 30 days.
Description
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Hp | Icewall Federation Agent | 3.0 | — |
| Apple | Watchos | <= 2.2.1 | — |
| Apple | Mac Os X | < 10.11.6 | — |
| Xmlsoft | Libxml2 | <= 2.9.3 | — |
| Apple | Icloud | < 5.2.1 | — |
| Apple | Iphone Os | <= 9.3.2 | — |
| Redhat | Enterprise Linux Desktop | 6.0 | — |
| Redhat | Enterprise Linux Desktop | 7.0 | — |
| Redhat | Enterprise Linux Server | 6.0 | — |
| Redhat | Enterprise Linux Server | 7.0 | — |
| Redhat | Enterprise Linux Server Aus | 7.2 | — |
| Redhat | Enterprise Linux Server Aus | 7.3 | — |
| Redhat | Enterprise Linux Server Aus | 7.4 | — |
| Redhat | Enterprise Linux Server Aus | 7.6 | — |
| Redhat | Enterprise Linux Server Aus | 7.7 | — |
| Redhat | Enterprise Linux Server Eus | 7.2 | — |
| Redhat | Enterprise Linux Server Eus | 7.3 | — |
| Redhat | Enterprise Linux Server Eus | 7.4 | — |
| Redhat | Enterprise Linux Server Eus | 7.5 | — |
| Redhat | Enterprise Linux Server Eus | 7.6 | — |
| Redhat | Enterprise Linux Server Eus | 7.7 | — |
| Redhat | Enterprise Linux Server Tus | 7.2 | — |
| Redhat | Enterprise Linux Server Tus | 7.3 | — |
| Redhat | Enterprise Linux Server Tus | 7.6 | — |
| Redhat | Enterprise Linux Server Tus | 7.7 | — |
| Redhat | Enterprise Linux Workstation | 6.0 | — |
| Redhat | Enterprise Linux Workstation | 7.0 | — |
| Apple | Itunes | <= 12.4.1 | — |
| Slackware | Slackware Linux | 14.0 | — |
| Slackware | Slackware Linux | 14.1 | — |
| Oracle | Vm Server | 3.3 | — |
| Oracle | Vm Server | 3.4 | — |
| Apple | Tvos | <= 9.2.1 | — |
| Tenable | Log Correlation Engine | 4.8.0 | — |
| Mcafee | Web Gateway | <= 7.5.2.10 | — |
| Mcafee | Web Gateway | >= 7.6.0.0, <= 7.6.2.3 | — |
| Oracle | Linux | 6 | — |
| Oracle | Linux | 7 | 0 |
References
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.htmlMailing List, Release Notes
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlMailing List, Release Notes
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.htmlMailing List, Release Notes
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.htmlMailing List, Release Notes
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.htmlMailing List, Release Notes
- http://rhn.redhat.com/errata/RHSA-2016-2957.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/05/25/2Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
- http://www.securityfocus.com/bid/90856Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036348Third Party Advisory, VDB Entry
- http://xmlsoft.org/news.htmlRelease Notes
- https://access.redhat.com/errata/RHSA-2016:1292Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1338700Issue Tracking, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10170Third Party Advisory
- https://support.apple.com/HT206899Release Notes
- https://support.apple.com/HT206901Release Notes
- https://support.apple.com/HT206902Release Notes
- https://support.apple.com/HT206903Release Notes
- https://support.apple.com/HT206904Release Notes
- https://support.apple.com/HT206905Release Notes
- https://www.tenable.com/security/tns-2016-18Third Party Advisory
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.htmlMailing List, Release Notes
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlMailing List, Release Notes
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.htmlMailing List, Release Notes
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.htmlMailing List, Release Notes
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.htmlMailing List, Release Notes
- http://rhn.redhat.com/errata/RHSA-2016-2957.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/05/25/2Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
- http://www.securityfocus.com/bid/90856Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036348Third Party Advisory, VDB Entry
- http://xmlsoft.org/news.htmlRelease Notes
- https://access.redhat.com/errata/RHSA-2016:1292Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1338700Issue Tracking, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10170Third Party Advisory
- https://support.apple.com/HT206899Release Notes
- https://support.apple.com/HT206901Release Notes
- https://support.apple.com/HT206902Release Notes
- https://support.apple.com/HT206903Release Notes
- https://support.apple.com/HT206904Release Notes
- https://support.apple.com/HT206905Release Notes
- https://www.tenable.com/security/tns-2016-18Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-4448?
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
How severe is CVE-2016-4448?
CVE-2016-4448 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 7.04% probability of exploitation in the next 30 days.
How do I fix CVE-2016-4448?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2016-4448?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST