CVE-2016-1836: apple iphone_os Use After Free

Modified

AliasesUBUNTU-CVE-2016-1836DEBIAN-CVE-2016-1836

Published 20-05-2016Last modified 05-08-2024

Vulnerability summary

CVE-2016-1836 is a medium (CVSS 5.5) Use After Free vulnerability in apple iphone_os. EPSS estimates a 4.27% chance of exploitation in the next 30 days, higher than 91% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.0 (NVD)

EPSS score

4.27%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 3

DSA-3593-1 MGASA-2016-0263 OPENSUSE-SU-2024:10192-1 OPENSUSE-SU-2024:10228-1 RHSA-2016:1292 USN-2994-1

Timeline

20-05-2016
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.05.5v2.04.3

EPSS trend

Probability

4.27%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.27% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat6 products

enterprise_linux_desktop6.0 | 7.0
enterprise_linux_server6.0 | 7.0
enterprise_linux_server_aus7.2 | 7.3 | 7.4 | 7.6
enterprise_linux_server_eus7.2 | 7.3 | 7.4 | 7.5 | 7.6
enterprise_linux_server_tus7.2 | 7.3 | 7.6

Show all 6

Apple4 products

iphone_os< 9.3.2
mac_os_x< 10.11.5
tvos< 9.2.1
watchos< 2.2.1

Debian2 products

libxml2< 2.9.3+dfsg1-1.1
debian_linuxEOL8.0

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 15.10 | 16.04

Mcafee1 product

web_gateway≥ 7.5.0.0, ≤ 7.5.2.10 | ≥ 7.6.0.0, ≤ 7.6.2.3

Ubuntu1 product

libxml2< 2.9.1+dfsg1-3ubuntu4.8 | < 2.9.3+dfsg1-1ubuntu0.1

Xmlsoft1 product

libxml2< 2.9.4

7 vendors · 16 products

References

38 links

www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlX Refsource CONFIRMThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10170X Refsource CONFIRMPatchThird Party Advisory
access.redhat.com/errata/RHSA-2016:1292Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlX Refsource CONFIRMThird Party Advisory
support.apple.com/HT206567X Refsource CONFIRMVendor AdvisoryREPORT
www.securityfocus.com/bid/90691VDB EntryX Refsource BIDThird Party Advisory
www.debian.org/security/2016/dsa-3593Vendor AdvisoryX Refsource DEBIANThird Party Advisory
lists.apple.com/archives/security-announce/2016/Jul/msg00003.htmlVendor AdvisoryX Refsource APPLEMailing ListNot Applicable
lists.apple.com/archives/security-announce/2016/Jul/msg00002.htmlVendor AdvisoryX Refsource APPLEMailing List
lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing List

Show all 38 references

git.gnome.org/browse/libxml2/commit/?id=45752d2c334b50016666d8f0ec3691e2d680f0a0X Refsource CONFIRMPatchThird Party Advisory
xmlsoft.org/news.htmlX Refsource CONFIRMRelease NotesVendor Advisory
support.apple.com/HT206901X Refsource CONFIRMVendor Advisory
lists.apple.com/archives/security-announce/2016/May/msg00004.htmlVendor AdvisoryX Refsource APPLEMailing ListREPORT
www.ubuntu.com/usn/USN-2994-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
support.apple.com/HT206566X Refsource CONFIRMVendor AdvisoryREPORT
www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlX Refsource CONFIRMThird Party Advisory
lists.apple.com/archives/security-announce/2016/Jul/msg00000.htmlVendor AdvisoryX Refsource APPLEMailing List
lists.apple.com/archives/security-announce/2016/Jul/msg00005.htmlVendor AdvisoryX Refsource APPLEMailing List
www.tenable.com/security/tns-2016-18X Refsource CONFIRMThird Party Advisory
lists.apple.com/archives/security-announce/2016/May/msg00003.htmlVendor AdvisoryX Refsource APPLEMailing ListREPORT
support.apple.com/HT206564X Refsource CONFIRMVendor AdvisoryREPORT
rhn.redhat.com/errata/RHSA-2016-2957.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
security.gentoo.org/glsa/201701-37Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www.securitytracker.com/id/1035890VDB EntryX Refsource SECTRACKThird Party Advisory
support.apple.com/HT206905X Refsource CONFIRMVendor Advisory
lists.apple.com/archives/security-announce/2016/May/msg00002.htmlVendor AdvisoryX Refsource APPLEMailing ListREPORT
support.apple.com/HT206903X Refsource CONFIRMVendor Advisory
support.apple.com/HT206902X Refsource CONFIRMVendor Advisory
bugzilla.gnome.org/show_bug.cgi?id=759398X Refsource CONFIRMPermissions RequiredThird Party Advisory
support.apple.com/HT206904X Refsource CONFIRMVendor Advisory
support.apple.com/HT206568X Refsource CONFIRMVendor AdvisoryREPORT
lists.apple.com/archives/security-announce/2016/May/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListREPORT
support.apple.com/HT206899X Refsource CONFIRMVendor Advisory
ubuntu.com/security/CVE-2016-1836REPORT
ubuntu.com/security/notices/USN-2994-1Advisory
www.cve.org/CVERecord?id=CVE-2016-1836REPORT
security-tracker.debian.org/tracker/CVE-2016-1836Advisory