Vulnerability-Lookup

USN-2994-1 (UBUNTU-CVE-2015-8806)

Vulnerability from osv_ubuntu – Published: 2016-06-06 16:43 – Updated: 2026-04-22 07:36 – Source website

Summary

libxml2 vulnerabilities

Details

It was discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447)

It was discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-1762, CVE-2016-1834)

Mateusz Jurczyk discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-1833, CVE-2016-1838, CVE-2016-1839)

Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-1835, CVE-2016-1837)

Kostya Serebryany discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-1840)

It was discovered that libxml2 would load certain XML external entities. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly obtain access to arbitrary files or cause resource consumption. (CVE-2016-4449)

Gustavo Grieco discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. (CVE-2016-4483)

References

URL

Type

	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://ubuntu.com/security/CVE-2015-8806	REPORT
	https://ubuntu.com/security/CVE-2016-1762	REPORT
	https://ubuntu.com/security/CVE-2016-1833	REPORT
	https://ubuntu.com/security/CVE-2016-1834	REPORT
	https://ubuntu.com/security/CVE-2016-1835	REPORT
	https://ubuntu.com/security/CVE-2016-1836	REPORT
	https://ubuntu.com/security/CVE-2016-1837	REPORT
	https://ubuntu.com/security/CVE-2016-1838	REPORT
	https://ubuntu.com/security/CVE-2016-1839	REPORT
	https://ubuntu.com/security/CVE-2016-1840	REPORT
	https://ubuntu.com/security/CVE-2016-2073	REPORT
	https://ubuntu.com/security/CVE-2016-3627	REPORT
	https://ubuntu.com/security/CVE-2016-3705	REPORT
	https://ubuntu.com/security/CVE-2016-4447	REPORT
	https://ubuntu.com/security/CVE-2016-4449	REPORT
	https://ubuntu.com/security/CVE-2016-4483	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2015-8806",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1762",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1833",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1834",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1835",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1836",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1837",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1838",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1839",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1840",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-2073",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3627",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3705",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-4447",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-4449",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-4483",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2015-8806",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1762",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1833",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1834",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1835",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1836",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1837",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1838",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1839",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1840",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-2073",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3627",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3705",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-4447",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-4449",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-4483",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that libxml2 incorrectly handled certain malformed\ndocuments. If a user or automated system were tricked into opening a\nspecially crafted document, an attacker could possibly cause libxml2 to\ncrash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073,\nCVE-2016-3627, CVE-2016-3705, CVE-2016-4447)\n\nIt was discovered that libxml2 incorrectly handled certain malformed\ndocuments. If a user or automated system were tricked into opening a\nspecially crafted document, an attacker could cause libxml2 to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2016-1762, CVE-2016-1834)\n\nMateusz Jurczyk discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could cause libxml2 to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-1833, CVE-2016-1838, CVE-2016-1839)\n\nWei Lei and Liu Yang discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could cause libxml2 to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-1835, CVE-2016-1837)\n\nWei Lei and Liu Yang discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could cause libxml2 to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and\nUbuntu 16.04 LTS. (CVE-2016-1836)\n\nKostya Serebryany discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could cause libxml2 to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-1840)\n\nIt was discovered that libxml2 would load certain XML external entities. If\na user or automated system were tricked into opening a specially crafted\ndocument, an attacker could possibly obtain access to arbitrary files or\ncause resource consumption. (CVE-2016-4449)\n\nGustavo Grieco discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could possibly cause\nlibxml2 to crash, resulting in a denial of service. (CVE-2016-4483)\n",
  "id": "USN-2994-1",
  "modified": "2026-04-22T07:36:33Z",
  "published": "2016-06-06T16:43:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-8806"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1762"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1833"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1834"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1835"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1836"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1837"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1838"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1839"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1840"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-2073"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-3627"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-3705"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-4447"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-4449"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-4483"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "libxml2 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2015-8806",
    "UBUNTU-CVE-2016-1762",
    "UBUNTU-CVE-2016-1833",
    "UBUNTU-CVE-2016-1834",
    "UBUNTU-CVE-2016-1835",
    "UBUNTU-CVE-2016-1836",
    "UBUNTU-CVE-2016-1837",
    "UBUNTU-CVE-2016-1838",
    "UBUNTU-CVE-2016-1839",
    "UBUNTU-CVE-2016-1840",
    "UBUNTU-CVE-2016-2073",
    "UBUNTU-CVE-2016-3627",
    "UBUNTU-CVE-2016-3705",
    "UBUNTU-CVE-2016-4447",
    "UBUNTU-CVE-2016-4449",
    "UBUNTU-CVE-2016-4483"
  ]
}

UBUNTU-CVE-2015-8806 (CVE-2015-8806)

Vulnerability from osv_ubuntu – Published: 2016-04-13 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2015-8806	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2015-8806	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"\u003c!DOCTYPE html\" substring in a crafted HTML document.",
  "id": "UBUNTU-CVE-2015-8806",
  "modified": "2026-04-22T07:37:52Z",
  "published": "2016-04-13T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-8806"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-8806"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2015-8806"
  ]
}

UBUNTU-CVE-2016-1762 (CVE-2016-1762)

Vulnerability from osv_ubuntu – Published: 2016-03-23 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

Severity

8.1 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1762	REPORT
	https://support.apple.com/HT206171	REPORT
	https://support.apple.com/HT206169	REPORT
	https://support.apple.com/HT206168	REPORT
	https://support.apple.com/HT206167	REPORT
	https://support.apple.com/HT206166	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1762	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.",
  "id": "UBUNTU-CVE-2016-1762",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-03-23T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1762"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206171"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206169"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206168"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206167"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206166"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1762"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1762"
  ]
}

UBUNTU-CVE-2016-1833 (CVE-2016-1833)

Vulnerability from osv_ubuntu – Published: 2016-05-20 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1833	REPORT
	https://support.apple.com/HT206568	REPORT
	https://support.apple.com/HT206567	REPORT
	https://support.apple.com/HT206566	REPORT
	https://support.apple.com/HT206564	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1833	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.",
  "id": "UBUNTU-CVE-2016-1833",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1833"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206568"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206567"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206566"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206564"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00003.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00002.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00001.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1833"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1833"
  ]
}

UBUNTU-CVE-2016-1834 (CVE-2016-1834)

Vulnerability from osv_ubuntu – Published: 2016-05-20 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

Severity

7.8 (High)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1834	REPORT
	https://support.apple.com/HT206564	REPORT
	https://support.apple.com/HT206566	REPORT
	https://support.apple.com/HT206567	REPORT
	https://support.apple.com/HT206568	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1834	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.",
  "id": "UBUNTU-CVE-2016-1834",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1834"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206564"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206566"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206567"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206568"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00001.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00002.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00003.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1834"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1834"
  ]
}

UBUNTU-CVE-2016-1835 (CVE-2016-1835)

Vulnerability from osv_ubuntu – Published: 2016-05-20 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.

Severity

8.8 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1835	REPORT
	https://support.apple.com/HT206567	REPORT
	https://support.apple.com/HT206568	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1835	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.",
  "id": "UBUNTU-CVE-2016-1835",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1835"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206567"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206568"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00002.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1835"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1835"
  ]
}

UBUNTU-CVE-2016-1836 (CVE-2016-1836)

Vulnerability from osv_ubuntu – Published: 2016-05-20 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1836	REPORT
	https://support.apple.com/HT206564	REPORT
	https://support.apple.com/HT206566	REPORT
	https://support.apple.com/HT206567	REPORT
	https://support.apple.com/HT206568	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1836	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document.",
  "id": "UBUNTU-CVE-2016-1836",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1836"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206564"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206566"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206567"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206568"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00001.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00002.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00003.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1836"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1836"
  ]
}

UBUNTU-CVE-2016-1837 (CVE-2016-1837)

Vulnerability from osv_ubuntu – Published: 2016-05-20 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1837	REPORT
	https://support.apple.com/HT206564	REPORT
	https://support.apple.com/HT206566	REPORT
	https://support.apple.com/HT206567	REPORT
	https://support.apple.com/HT206568	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1837	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.",
  "id": "UBUNTU-CVE-2016-1837",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1837"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206564"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206566"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206567"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206568"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00001.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00002.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00003.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1837"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1837"
  ]
}

UBUNTU-CVE-2016-1838 (CVE-2016-1838)

Vulnerability from osv_ubuntu – Published: 2016-05-20 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1838	REPORT
	https://support.apple.com/HT206564	REPORT
	https://support.apple.com/HT206566	REPORT
	https://support.apple.com/HT206567	REPORT
	https://support.apple.com/HT206568	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1838	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.",
  "id": "UBUNTU-CVE-2016-1838",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1838"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206564"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206566"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206567"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206568"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00001.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00002.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00003.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1838"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1838"
  ]
}

UBUNTU-CVE-2016-1839 (CVE-2016-1839)

Vulnerability from osv_ubuntu – Published: 2016-05-20 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1839	REPORT
	https://support.apple.com/HT206564	REPORT
	https://support.apple.com/HT206566	REPORT
	https://support.apple.com/HT206567	REPORT
	https://support.apple.com/HT206568	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1839	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.",
  "id": "UBUNTU-CVE-2016-1839",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1839"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206564"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206566"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206567"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206568"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00001.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00002.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00003.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1839"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1839"
  ]
}

UBUNTU-CVE-2016-1840 (CVE-2016-1840)

Vulnerability from osv_ubuntu – Published: 2016-05-20 00:00 – Updated: 2026-04-22 07:37 – Source website

Details

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

Severity

7.8 (High)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-1840	REPORT
	https://support.apple.com/HT206564	REPORT
	https://support.apple.com/HT206566	REPORT
	https://support.apple.com/HT206567	REPORT
	https://support.apple.com/HT206568	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	http://lists.apple.com/archives/security-announce…	REPORT
	https://ubuntu.com/security/notices/USN-2994-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-1840	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.1+dfsg1-3ubuntu4.8"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.1+dfsg1-3ubuntu4.8?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.1+dfsg1-3ubuntu4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.1+dfsg1-3ubuntu2",
        "2.9.1+dfsg1-3ubuntu3",
        "2.9.1+dfsg1-3ubuntu4",
        "2.9.1+dfsg1-3ubuntu4.1",
        "2.9.1+dfsg1-3ubuntu4.2",
        "2.9.1+dfsg1-3ubuntu4.3",
        "2.9.1+dfsg1-3ubuntu4.4",
        "2.9.1+dfsg1-3ubuntu4.5",
        "2.9.1+dfsg1-3ubuntu4.6",
        "2.9.1+dfsg1-3ubuntu4.7"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "libxml2-utils",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          },
          {
            "binary_name": "python-libxml2",
            "binary_version": "2.9.3+dfsg1-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libxml2",
        "purl": "pkg:deb/ubuntu/libxml2@2.9.3+dfsg1-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.3+dfsg1-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.9.2+zdfsg1-4",
        "2.9.2+zdfsg1-4ubuntu1",
        "2.9.2+zdfsg1-4ubuntu2",
        "2.9.2+zdfsg1-4ubuntu3",
        "2.9.3+dfsg1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.",
  "id": "UBUNTU-CVE-2016-1840",
  "modified": "2026-04-22T07:37:54Z",
  "published": "2016-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1840"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206564"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206566"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206567"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/HT206568"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00001.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00002.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00003.html"
    },
    {
      "type": "REPORT",
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2994-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-1840"
    }
  ],
  "related": [
    "USN-2994-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-1840"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

USN-2994-1 (UBUNTU-CVE-2015-8806)

UBUNTU-CVE-2015-8806 (CVE-2015-8806)

UBUNTU-CVE-2016-1762 (CVE-2016-1762)

UBUNTU-CVE-2016-1833 (CVE-2016-1833)

UBUNTU-CVE-2016-1834 (CVE-2016-1834)

UBUNTU-CVE-2016-1835 (CVE-2016-1835)

UBUNTU-CVE-2016-1836 (CVE-2016-1836)

UBUNTU-CVE-2016-1837 (CVE-2016-1837)

UBUNTU-CVE-2016-1838 (CVE-2016-1838)

UBUNTU-CVE-2016-1839 (CVE-2016-1839)

UBUNTU-CVE-2016-1840 (CVE-2016-1840)

Tags

Sightings

Nomenclature

Related by attack behaviour