Use-after-free in Libxml2 - CVE-2016-4658

Vulnerability identifier: #VU57346

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-4658

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error, caused by using namespace nodes in XPointer ranges within the xpointer.c in libxml2. A remote attackers can pass specially crated XML document to he application, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Libxml2
Arch Linux
CentOS
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Fedora
Red Hat Advanced Cluster Management for Kubernetes
App Connect Enterprise Certified Container
Session Smart Router
IBM Security Guardium
libxml2 (Red Hat package)
libxml2
Contrail Networking

Install update from vendor's website.

Libxml2 - update to 2.9.5
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.1.12, 2.3.3
libxml2 (Red Hat package) - update to 2.9.1-6.el7_9.6
libxml2 - update to 2.9.4
libxml2 - addressed in versions 2.9.7-1.fc26, 2.9.7-1.fc27
App Connect Enterprise Certified Container - addressed in versions 5.0.1, 6.1.0
Session Smart Router - addressed in versions 5.4.7, 5.5.3
Contrail Networking - update to 2011.L5

• http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
• http://www.securityfocus.com/bid/93054
• http://www.securitytracker.com/id/1036858
• http://www.securitytracker.com/id/1038623
• https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b
• https://security.gentoo.org/glsa/201701-37
• https://support.apple.com/HT207141
• https://support.apple.com/HT207142
• https://support.apple.com/HT207143
• https://support.apple.com/HT207170

• Remote code execution in libxml2
• Red Hat Enterprise Linux 7 update for libxml2
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.1
• CentOS 7 update for libxml2
• Multiple vulnerabilities in Juniper Networks Contrail Networking
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• Multiple vulnerabilities in IBM Security Guardium
• Remote code execution in IBM App Connect Enterprise Certified Container
• Arch Linux update for libxml2
• Fedora 27 update for libxml2
• Fedora 26 update for libxml2