by Kastro
Paper/Archive/CVE-2016-4658

CVE-2016-4658

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP — xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other pr…

EPSS 9%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 95.1.951 × 2019.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

Scores by source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsupport.apple.com/HT207141refsecuritytracker.com/id/1036858advisorylists.apple.com/archives/security-announce/2016/Sep/msg00006.htmladvisorylists.apple.com/archives/security-announce/2016/Sep/msg00008.htmladvisorylists.apple.com/archives/security-announce/2016/Sep/msg00010.htmladvisorylists.apple.com/archives/security-announce/2016/Sep/msg00011.htmlrefsecurityfocus.com/bid/93054refsupport.apple.com/HT207170advisorysecurity.gentoo.org/glsa/201701-37refsupport.apple.com/HT207142refsupport.apple.com/HT207143refsecuritytracker.com/id/1038623refgit.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344brefcert-portal.siemens.com/productcert/html/ssa-398330.html