CVE-2016-4609
CriticalSummary
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Risk Assessment
This vulnerability may lead to significant disruptions in the operation of systems and services, potentially affecting the availability and integrity of data within the organization.
Recommendation
It is recommended to update all affected components to the latest versions to minimize the risk associated with this vulnerability.
Other vulnerabilities in libxslt
See all- CVE-2019-18197High
In libxslt 1.1.33, the xsltCopyText function does not reset a pointer under certain circumstances. This may lead to writing data outside a buffer or disclosing uninitialized data.
- CVE-2016-4738High
libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2016-1684High
In libxslt before version 1.1.29, used in Google Chrome before version 51.0.2704.63, there is a mishandling of the i format token for xsl:number data. This allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.
- CVE-2016-1841High
libxslt in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2025-24855Medium
In libxslt before 1.1.43, numbers.c has a use-after-free because in nested XPath evaluations, an XPath context node can be modified but never restored. Affects xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
- CVE-2024-55549Medium
In libxslt before 1.1.43, xsltGetInheritedNsList has a use-after-free issue related to exclusion of result prefixes.
- CVE-2019-11068Critical
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
- CVE-2017-2477Critical
An issue was discovered in certain Apple products, including macOS before 10.12.4, related to the 'libxslt' component. This issue may lead to denial of service (memory corruption) or potentially other unspecified impacts via unknown vectors.
- CVE-2016-4610Critical
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 has a vulnerability that allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
- CVE-2016-4608Critical
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Original NVD description (English source)
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612.