Skip to content
OpenAdvisories
High RHSA-2016:1292 14 CVEs

Red Hat Security Advisory: libxml2 security update

Published Sep 15, 2024 · Updated Sep 21, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client libxml2 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::client libxml2-debuginfo 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::client libxml2-devel 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::client libxml2-python 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::client libxml2-static 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2-debuginfo 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2-devel 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2-python 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::computenode libxml2-static 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2-debuginfo 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2-devel 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2-python 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::server libxml2-static 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2-debuginfo 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2-devel 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2-python 0:2.7.6-21.el6_8.1
Red Hat · RHEL 6 enterprise_linux:6::workstation libxml2-static 0:2.7.6-21.el6_8.1
Red Hat · RHEL 7 enterprise_linux:7::client libxml2 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::client libxml2-debuginfo 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::client libxml2-devel 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::client libxml2-python 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::client libxml2-static 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::computenode libxml2 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::computenode libxml2-debuginfo 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::computenode libxml2-devel 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::computenode libxml2-python 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::computenode libxml2-static 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::server libxml2 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::server libxml2-debuginfo 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::server libxml2-devel 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::server libxml2-python 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::server libxml2-static 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::workstation libxml2 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::workstation libxml2-debuginfo 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::workstation libxml2-devel 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::workstation libxml2-python 0:2.9.1-6.el7_2.3
Red Hat · RHEL 7 enterprise_linux:7::workstation libxml2-static 0:2.9.1-6.el7_2.3

Vulnerabilities 14

  • High 8.1
    CVE-2016-1762

    The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffe…

    libxml2 libxml2 Debian Ubuntu
  • High 7.8
    CVE-2016-1834 Public exploit

    Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X …

    libxml2 libxml2 Debian Ubuntu
  • High 7.5
    CVE-2016-3627 Public exploit

    The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-de…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1833

    The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1835

    Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1836

    Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1837

    Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in lib…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1838 Public exploit

    The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before …

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1839 Public exploit

    The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS bef…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1840

    Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before …

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-3705

    The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly kee…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-4447 EPSS 14%

    The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a deni…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-4448

    Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string speci…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-4449

    XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4,…

    libxml2 libxml2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1319829
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1332443
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338682
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338686
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338691
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338696
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338700
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338701
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338702
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338703
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338705
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338706
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338708
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1338711
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1292.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-1762
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1762
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1762
  • report
    https://access.redhat.com/security/cve/CVE-2016-1833
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1833
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1833
  • report
    https://access.redhat.com/security/cve/CVE-2016-1834
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1834
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1834
  • report
    https://access.redhat.com/security/cve/CVE-2016-1835
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1835
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1835
  • report
    https://access.redhat.com/security/cve/CVE-2016-1836
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1836
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1836
  • report
    https://access.redhat.com/security/cve/CVE-2016-1837
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1837
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1837
  • report
    https://access.redhat.com/security/cve/CVE-2016-1838
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1838
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1838
  • report
    https://access.redhat.com/security/cve/CVE-2016-1839
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1839