Description
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Apple / iphone_os10.0
- Apple / mac_os_x10.12
- Apple / tvOS10.0
- Apple / watchOS3.0
- Canonical / Ubuntu Linux16.04 – 16.04
- Canonical / Ubuntu Linux14.04 – 14.04
- Debian / debian_linux8.0 – 8.0
- Debian / debian_linux9.0 – 9.0
- Google / Chrome52.0.2743.82
- openSUSE / Leap42.1 – 42.1
- openSUSE / opensuse13.2 – 13.2
- openSUSE / opensuse13.1 – 13.1
- RedHat / enterprise_linux_desktop6.0 – 6.0
- RedHat / enterprise_linux_server6.0 – 6.0
- RedHat / enterprise_linux_workstation6.0 – 6.0
- SUSE / linux_enterprise12.0 – 12.0
- xmlsoft / libxml22.9.4
References
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=1358641
- VENDOR_ADVISORYhttps://support.apple.com/HT207141
- MISChttps://crbug.com/623378
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html
- MAILING_LISThttp://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
- MAILING_LISThttp://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
- MISChttp://www.securityfocus.com/bid/92053
- MISChttp://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html
- MAILING_LISThttp://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
- VENDOR_ADVISORYhttp://www.ubuntu.com/usn/USN-3041-1
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html
- MISChttps://source.android.com/security/bulletin/2017-05-01
- MISChttps://codereview.chromium.org/2127493002
- MAILING_LISThttp://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
- VENDOR_ADVISORYhttps://support.apple.com/HT207170
- MISChttps://security.gentoo.org/glsa/201610-09
- MISChttps://security.gentoo.org/glsa/201701-37
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html
- VENDOR_ADVISORYhttps://support.apple.com/HT207142
- VENDOR_ADVISORYhttps://support.apple.com/HT207143
- MISChttp://rhn.redhat.com/errata/RHSA-2016-1485.html
- MISChttp://www.securitytracker.com/id/1038623
- MISChttp://www.securitytracker.com/id/1036428
- VENDOR_ADVISORYhttp://www.debian.org/security/2016/dsa-3637
Updated 26m ago · 8 sources