vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2016-1837

N/A
Published: May 20, 2016 at 10:00 AM UTC
Updated: June 17, 2026 at 12:42 AM UTC
14 products affected across 6 vendorsmacOSDebian LinuxiPhone OS

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 4%

Description

Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

iPhone OS· Apple
95%
v < 9.3.2
Affected range stops below 9.3.2, so it looks safe — our inference, not a vendor statement
macOS· Apple
95%
v < 10.11.5
Affected range stops below 10.11.5, so it looks safe — our inference, not a vendor statement
tvOS· Apple
95%
v < 9.2.1
Affected range stops below 9.2.1, so it looks safe — our inference, not a vendor statement
watchOS· Apple
95%
v < 2.2.1
Affected range stops below 2.2.1, so it looks safe — our inference, not a vendor statement
Ubuntu Linux· Canonicalrubygems
95%
12.0414.0415.1016.04
Debian Linux· Debiandrupal
95%
8.0
Web Gateway· McAfee
95%
7.5.0.0 ≤ v ≤ 7.5.2.107.6.0.0 ≤ v ≤ 7.6.2.3
Enterprise Linux Desktop· Red Hatrubygems
95%
6.07.0
Enterprise Linux Server· Red Hatrubygems
95%
6.07.0
Enterprise Linux Server Aus· Red Hatrubygems
95%
7.27.37.47.6

References (22)

Vendor Advisoryx_refsource_APPLEMailing List
Source: [email protected]
http://lists.apple.com/archives/security-announce/2016/May/msg00001.html
Vendor Advisoryx_refsource_APPLEMailing List
Source: [email protected]
http://lists.apple.com/archives/security-announce/2016/May/msg00002.html
Vendor Advisoryx_refsource_APPLEMailing List
Source: [email protected]
http://lists.apple.com/archives/security-announce/2016/May/msg00003.html
Vendor Advisoryx_refsource_APPLEMailing List
Source: [email protected]
http://lists.apple.com/archives/security-announce/2016/May/msg00004.html
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
http://rhn.redhat.com/errata/RHSA-2016-2957.html
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

CVSS

4.3MEDIUM[email protected]
Confidentiality
NONE
Integrity
NONE
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card