Skip to content
OpenAdvisories
High USN-2994-1 16 CVEs

libxml2 vulnerabilities

Published Jun 6, 2016 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could possibly cause libxml2 to
crash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073,
CVE-2016-3627, CVE-2016-3705, CVE-2016-4447)

It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could cause libxml2 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-1762, CVE-2016-1834)

Mateusz Jurczyk discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1833, CVE-2016-1838, CVE-2016-1839)

Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1835, CVE-2016-1837)

Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and
Ubuntu 16.04 LTS. (CVE-2016-1836)

Kostya Serebryany discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1840)

It was discovered that libxml2 would load certain XML external entities. If
a user or automated system were tricked into opening a specially crafted
document, an attacker could possibly obtain access to arbitrary files or
cause resource consumption. (CVE-2016-4449)

Gustavo Grieco discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could possibly cause
libxml2 to crash, resulting in a denial of service. (CVE-2016-4483)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS libxml2 2.9.1+dfsg1-3ubuntu4.8
Ubuntu · 16.04 LTS 16.04:LTS libxml2 2.9.3+dfsg1-1ubuntu0.1

Vulnerabilities 16

  • High 8.1
    CVE-2016-1762

    The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffe…

    libxml2 libxml2 Debian Ubuntu
  • High 7.8
    CVE-2016-1834 Public exploit

    Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X …

    libxml2 libxml2 Debian Ubuntu
  • High 7.5
    CVE-2015-8806

    Denial of service or RCE from libxml2 and libxslt

    dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.

    libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  • High 7.5
    CVE-2016-3627 Public exploit

    The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-de…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1833

    The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1835

    Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1836

    Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1837

    Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in lib…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1838 Public exploit

    The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before …

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1839 Public exploit

    The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS bef…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-1840

    Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before …

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-2073

    The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-boun…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-3705

    The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly kee…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-4447 EPSS 14%

    The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a deni…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-4449

    XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4,…

    libxml2 libxml2 Debian Ubuntu
  • Unscored —
    CVE-2016-4483

    The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial…

    libxml2 libxml2 Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-8806
  • report
    https://ubuntu.com/security/CVE-2016-1762
  • report
    https://ubuntu.com/security/CVE-2016-1833
  • report
    https://ubuntu.com/security/CVE-2016-1834
  • report
    https://ubuntu.com/security/CVE-2016-1835
  • report
    https://ubuntu.com/security/CVE-2016-1836
  • report
    https://ubuntu.com/security/CVE-2016-1837
  • report
    https://ubuntu.com/security/CVE-2016-1838
  • report
    https://ubuntu.com/security/CVE-2016-1839
  • report
    https://ubuntu.com/security/CVE-2016-1840
  • report
    https://ubuntu.com/security/CVE-2016-2073
  • report
    https://ubuntu.com/security/CVE-2016-3627
  • report
    https://ubuntu.com/security/CVE-2016-3705
  • report
    https://ubuntu.com/security/CVE-2016-4447
  • report
    https://ubuntu.com/security/CVE-2016-4449
  • report
    https://ubuntu.com/security/CVE-2016-4483