CVE-2016-1837: apple iphone_os Use After Free

Modified

AliasesUBUNTU-CVE-2016-1837DEBIAN-CVE-2016-1837

Published 20-05-2016Last modified 05-08-2024

Vulnerability summary

CVE-2016-1837 is a medium (CVSS 5.5) Use After Free vulnerability in apple iphone_os. EPSS estimates a 4.45% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.0 (NVD)

EPSS score

4.45%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 9 · Related 5

DLA-503-1 DSA-3593-1 MGASA-2016-0263 OPENSUSE-SU-2024:10192-1 OPENSUSE-SU-2024:10228-1 RHSA-2016:1292+3 more

Timeline

20-05-2016
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.05.5v2.04.3

EPSS trend

Probability

4.45%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.45% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.gnome.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat6 products

enterprise_linux_desktop6.0 | 7.0
enterprise_linux_server6.0 | 7.0
enterprise_linux_server_aus7.2 | 7.3 | 7.4 | 7.6
enterprise_linux_server_eus7.2 | 7.3 | 7.4 | 7.5 | 7.6
enterprise_linux_server_tus7.2 | 7.3 | 7.6

Show all 6

Apple4 products

iphone_os< 9.3.2
mac_os_x< 10.11.5
tvos< 9.2.1
watchos< 2.2.1

Debian2 products

libxml2< 2.9.3+dfsg1-1.1
debian_linuxEOL8.0

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 15.10 | 16.04

Mcafee1 product

web_gateway≥ 7.5.0.0, ≤ 7.5.2.10 | ≥ 7.6.0.0, ≤ 7.6.2.3

Ubuntu1 product

libxml2< 2.9.1+dfsg1-3ubuntu4.8 | < 2.9.3+dfsg1-1ubuntu0.1

Xmlsoft1 product

libxml2< 2.9.4

7 vendors · 16 products

References

26 links

www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlX Refsource CONFIRMThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10170X Refsource CONFIRMPatchThird Party Advisory
access.redhat.com/errata/RHSA-2016:1292Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlX Refsource CONFIRMThird Party Advisory
support.apple.com/HT206567X Refsource CONFIRMVendor AdvisoryREPORT
www.securityfocus.com/bid/90691VDB EntryX Refsource BIDThird Party Advisory
www.debian.org/security/2016/dsa-3593Vendor AdvisoryX Refsource DEBIANThird Party Advisory
xmlsoft.org/news.htmlX Refsource CONFIRMRelease NotesVendor Advisory
lists.apple.com/archives/security-announce/2016/May/msg00004.htmlVendor AdvisoryX Refsource APPLEMailing ListREPORT
www.ubuntu.com/usn/USN-2994-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory

Show all 26 references

support.apple.com/HT206566X Refsource CONFIRMVendor AdvisoryREPORT
www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlX Refsource CONFIRMThird Party Advisory
git.gnome.org/browse/libxml2/commit/?id=11ed4a7a90d5ce156a18980a4ad4e53e77384852X Refsource CONFIRMPatchThird Party Advisory
www.tenable.com/security/tns-2016-18X Refsource CONFIRMThird Party Advisory
lists.apple.com/archives/security-announce/2016/May/msg00003.htmlVendor AdvisoryX Refsource APPLEMailing ListREPORT
support.apple.com/HT206564X Refsource CONFIRMVendor AdvisoryREPORT
rhn.redhat.com/errata/RHSA-2016-2957.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securitytracker.com/id/1035890VDB EntryX Refsource SECTRACKThird Party Advisory
lists.apple.com/archives/security-announce/2016/May/msg00002.htmlVendor AdvisoryX Refsource APPLEMailing ListREPORT
support.apple.com/HT206568X Refsource CONFIRMVendor AdvisoryREPORT
bugzilla.gnome.org/show_bug.cgi?id=760263X Refsource CONFIRMExploitIssue TrackingThird Party Advisory
lists.apple.com/archives/security-announce/2016/May/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListREPORT
ubuntu.com/security/CVE-2016-1837REPORT
ubuntu.com/security/notices/USN-2994-1Advisory
www.cve.org/CVERecord?id=CVE-2016-1837REPORT
security-tracker.debian.org/tracker/CVE-2016-1837Advisory