요약
- CVE-2016-4658은(는) nokogiri, libxml2 (xmlsoft)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 8.6%, 전체 취약점의 95.1%보다 높음.
- 조치: 1.7.1, 2.9.5 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| nokogiri RubyGems | < 1.7.1
| 1.7.1
|
| libxml2 | < 2.9.5
| 2.9.5
|
Description
xpointer.c in libxml2 before 2.9.5 (as used in nokogiri before 1.7.1 amongst other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
NVD description
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free