{"id":"CVE-2016-4658","revision":"3e123b1ec4d44f649e33f785b3ac8f28","records":[{"revision":"3e123b1ec4d44f649e33f785b3ac8f28","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2016-4658","aliases":[],"title":"xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute ar…","description":"xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.","state":0,"publishedAt":"2016-09-25T10:00:00+00:00","modifiedAt":"2026-10-14T06:25:27.386+00:00","affected":[{"ecosystem":"Vendor product","name":"n/a","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"n/a\",\n                    \"vendor\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"n/a\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://support.apple.com/HT207141","http://www.securitytracker.com/id/1036858","http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html","http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html","http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html","http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html","http://www.securityfocus.com/bid/93054","https://support.apple.com/HT207170","https://security.gentoo.org/glsa/201701-37","https://support.apple.com/HT207142","https://support.apple.com/HT207143","http://www.securitytracker.com/id/1038623","https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2016-4658","license":"CVE Program Terms of Use","key":"cve-program:CVE-2016-4658","identifiers":["CVE-2016-4658"]},"retained":false,"historicalAffected":[]}],"coverage":[]}