Skip to content
OpenAdvisories
Critical DSA-3744-1 2 CVEs

libxml2 - security update

Published Dec 23, 2016 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 libxml2 2.9.1+dfsg1-5+deb8u4

Vulnerabilities 2

  • Critical 9.8
    CVE-2016-4658

    Nokogiri does not forbid namespace nodes in XPointer ranges

    xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cau…

    libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  • High 8.8
    CVE-2016-5131

    Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote atta…

    chromium-browser oxide-qt libxml2 libxml2 Debian Ubuntu Alpine