ID

VAR-201609-0238

CVE

CVE-2016-4738

TITLE

plural Apple Product libxslt Vulnerable to arbitrary code execution

DESCRIPTION

libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Apple iOS, tvOS,MacOS and watchOS are prone to multiple security vulnerabilities. Attackers can exploit these issues to bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial-of-service condition, perform unauthorized actions and gain system privileges; this may aid in launching further attacks. Versions prior to iOS 10, watchOS 3, MacOS 10.12, and tvOS 10 are vulnerable. Apple iOS, watchOS, OS X El Capitan, and tvOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; watchOS is a smart watch operating system; OS X El Capitan is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. A memory corruption vulnerability exists in libxslt in several Apple products. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-09-20-3 iOS 10 The iOS 10 advisory has been updated to include additional entries as noted below. AppleMobileFileIntegrity Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A local application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the task port inheritance policy. This issue was addressed through improved validation of the process entitlement and Team ID. CVE-2016-4698: Pedro VilaASSa Entry added September 20, 2016 Assets Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker in a privileged network position may be able to block a device from receiving software updates Description: An issue existed in iOS updates, which did not properly secure user communications. This issue was addressed by using HTTPS for software updates. CVE-2016-4741: Raul Siles of DinoSec Audio Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A remote attacker may be able to execute arbitrary code Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4702: YoungJin Yoon, MinSik Shin, HoJae Han, Sunghyun Park, and Taekyoung Kwon of Information Security Lab, Yonsei University Entry added September 20, 2016 Certificate Trust Policy Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Update to the certificate trust policy Description: The certificate trust policy was updated. The complete list of certificates may be viewed at https://support.apple.com/kb/HT204132. Entry added September 20, 2016 CFNetwork Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A local user may be able to discover websites a user has visited Description: An issue existed in Local Storage deletion. This issue was addressed through improved Local Storage cleanup. CVE-2016-4707: an anonymous researcher Entry added September 20, 2016 CFNetwork Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may compromise user information Description: An input validation issue existed in the parsing of the set-cookie header. This issue was addressed through improved validation checking. CVE-2016-4708: Dawid Czagan of Silesia Security Lab Entry added September 20, 2016 CommonCrypto Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application using CCrypt may disclose sensitive plaintext if the output and input buffer are the same Description: An input validation issue existed in corecrypto. This issue was addressed through improved input validation. CVE-2016-4711: Max Lohrmann Entry added September 20, 2016 CoreCrypto Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code Description: An out-of-bounds write issue was addressed by removing the vulnerable code. CVE-2016-4712: Gergo Koteles Entry added September 20, 2016 FontParser Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: A buffer overflow existed in the handling of font files. This issue was addressed through improved bounds checking. CVE-2016-4718: Apple Entry added September 20, 2016 GeoServices Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to read sensitive location information Description: A permissions issue existed in PlaceData. This issue was addressed through improved permission validation. CVE-2016-4719: Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt) IDS - Connectivity Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker in a privileged network position may be able to cause a denial of service Description: A spoofing issue existed in the handling of Call Relay. This issue was addressed through improved input validation. CVE-2016-4722: Martin Vigo (@martin_vigo) of salesforce.com Entry added September 20, 2016 IOAcceleratorFamily Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved input validation. CVE-2016-4724: Cererdlong, Eakerqiu of Team OverSky Entry added September 20, 2016 IOAcceleratorFamily Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: A memory corruption issue was addressed through improved input validation. CVE-2016-4725: Rodger Combs of Plex, Inc. Entry added September 20, 2016 IOAcceleratorFamily Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4726: an anonymous researcher Entry added September 20, 2016 Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A local application may be able to access restricted files Description: A parsing issue in the handling of directory paths was addressed through improved path validation. CVE-2016-4771: Balazs Bucsay, Research Director of MRG Effitas Entry added September 20, 2016 Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A remote attacker may be able to cause a denial of service Description: A lock handling issue was addressed through improved lock handling. CVE-2016-4772: Marc Heuse of mh-sec Entry added September 20, 2016 Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to determine kernel memory layout Description: Multiple out-of-bounds read issues existed that led to the disclosure of kernel memory. These were addressed through improved input validation. CVE-2016-4773: Brandon Azad CVE-2016-4774: Brandon Azad CVE-2016-4776: Brandon Azad Entry added September 20, 2016 Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: An untrusted pointer dereference was addressed by removing the affected code. CVE-2016-4777: Lufeng Li of Qihoo 360 Vulcan Team Entry added September 20, 2016 Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2016-4778: CESG Entry added September 20, 2016 Keyboards Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Keyboard auto correct suggestions may reveal sensitive information Description: The iOS keyboard was inadvertently caching sensitive information. This issue was addressed through improved heuristics. CVE-2016-4746: Antoine M of France libxml2 Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Multiple issues in libxml2, the most significant of which may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2016-4658: Nick Wellnhofer CVE-2016-5131: Nick Wellnhofer Entry added September 20, 2016 libxslt Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4738: Nick Wellnhofer Entry added September 20, 2016 Mail Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker with a privileged network position may be able to intercept mail credentials Description: An issue existed when handling untrusted certificates. This was addressed by terminating untrusted connections. CVE-2016-4747: Dave Aitel Messages Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Messages may be visible on a device that has not signed in to Messages Description: An issue existed when using Handoff for Messages. This issue was resolved via better state management. CVE-2016-4740: Step Wallace Printing UIKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An unencrypted document may be written to a temporary file when using AirPrint preview Description: An issue existed in AirPrint preview. This was addressed through improved environment sanitization. CVE-2016-4749: an anonymous researcher S2 Camera Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4750: Jack Tang (@jacktang310) and Moony Li of Trend Micro working with Trend Microas Zero Day Initiative Entry added September 20, 2016 Safari Reader Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting Description: Multiple validation issues were addressed through improved input sanitization. CVE-2016-4618: an anonymous researcher Entry added September 20, 2016 Sandbox Profiles Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious application may be able to determine whom a user is texting Description: An access control issue existed in SMS draft directories. This issue was addressed by preventing apps from stat'ing the affected directories. CVE-2016-4620: Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt) Security Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in signed disk images. This issue was addressed through improved size validation. CVE-2016-4753: Mark Mentovai of Google Inc. Entry added September 20, 2016 WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A parsing issue existed in the handling of error prototypes. This was addressed through improved validation. CVE-2016-4728: Daniel Divricean Entry added September 20, 2016 WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Visiting a maliciously crafted website may leak sensitive data Description: A permissions issue existed in the handling of the location variable. This was addressed though additional ownership checks. CVE-2016-4758: Masato Kinugawa of Cure53 Entry added September 20, 2016 WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2016-4611: Apple CVE-2016-4729: Apple CVE-2016-4730: Apple CVE-2016-4731: Apple CVE-2016-4734: Natalie Silvanovich of Google Project Zero CVE-2016-4735: AndrA(c) Bargull CVE-2016-4737: Apple CVE-2016-4759: Tongbo Luo of Palo Alto Networks CVE-2016-4762: Zheng Huang of Baidu Security Lab CVE-2016-4766: Apple CVE-2016-4767: Apple CVE-2016-4768: Anonymous working with Trend Micro's Zero Day Initiative Entry added September 20, 2016 WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious website may be able to access non-HTTP services Description: Safari's support of HTTP/0.9 allowed cross-protocol exploitation of non-HTTP services using DNS rebinding. The issue was addressed by restricting HTTP/0.9 responses to default ports and canceling resource loads if the document was loaded with a different HTTP protocol version. CVE-2016-4760: Jordan Milne Entry added September 20, 2016 WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved state management. CVE-2016-4733: Natalie Silvanovich of Google Project Zero CVE-2016-4765: Apple Entry added September 20, 2016 WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker in a privileged network position may be able to intercept and alter network traffic to applications using WKWebView with HTTPS Description: A certificate validation issue existed in the handling of WKWebView. This issue was addressed through improved validation. CVE-2016-4763: an anonymous researcher Entry added September 20, 2016 Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJX4XmJAAoJEIOj74w0bLRGF8MP+QE+9R4gRHqm60pjik77U5BQ QQGDt+VpQrXXCO0OqBiS6d7JLuZz7nBNWp33kRa1McJWgMeeXCOa5z4jlVhD2DPS dCWPjCFfLqaLJ2YZNkCdo5ugULfmq5R5aEdOnbXHl+b9S6boWNsYl2hlMcrPb9FY M7pSLyMuKCpXtQwU8XkHcf+YM7zpZCgBgpgKjIZ6wbMdJPtvkqtDmbpZgX69OeuY Q2imB/Oqgfn741E0Z3qooYPtGIHeGoH3Stonz8vsP6m6Fn24mqQAQ7uJcPc5Vbdv u04GiraN2wry6V9KAJCvnFbybn80SFum4+7l8zKHFQxVBG8Ns4ugxwMrgxWEhyZD q4J1S+dVX10Ir7hDOO+O7b2IA/nmriEbgeUnSxEZ/re62xHP6YT2wdUzAUWUd0xp j3AySRJhi64t1IxRTN3UXReHZgydgU34q6gy38TTie8EIueyLLgnQxDruD/8+Bes PUTjYC+0cbF8XYcvfGQ9CKgePgkc36sosT/JJxSbtmz8TUHmGPrqh4WxoyriIB+F Zldb5fn+TR8K8lSqjw8lb40uknHnUFiAtWDbtSh+eulBxzx2jGqWtihhEag6hbSc 2T/a/XpADjza6iXEojtzj5lNWvCT4SClcjvP+31pmd+8T+aqc8AcfgV+aXdUqhdG nMQ1SmBTu+2VRAwGOc4t =H/Kd -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3709-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso November 08, 2016 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libxslt CVE ID : CVE-2016-4738 Debian Bug : 842570 Nick Wellnhofer discovered that the xsltFormatNumberConversion function in libxslt, an XSLT processing runtime library, does not properly check for a zero byte terminating the pattern string. This flaw can be exploited to leak a couple of bytes after the buffer that holds the pattern string. For the stable distribution (jessie), this problem has been fixed in version 1.1.28-2+deb8u2. For the testing distribution (stretch), this problem has been fixed in version 1.1.29-2. For the unstable distribution (sid), this problem has been fixed in version 1.1.29-2. We recommend that you upgrade your libxslt packages. Alternatively, on your watch, select "My Watch > General > About". ========================================================================== Ubuntu Security Notice USN-3271-1 April 28, 2017 libxslt vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.04 - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in Libxslt. Software Description: - libxslt: XSLT processing library Details: Holger Fuhrmannek discovered an integer overflow in the xsltAddTextString() function in Libxslt. (CVE-2017-5029) Nicolas Gregoire discovered that Libxslt mishandled namespace nodes. An attacker could use this to craft a malicious document that, when opened, could cause a denial of service (application crash) or possibly execute arbtrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. (CVE-2016-1683) Sebastian Apelt discovered that a use-after-error existed in the xsltDocumentFunctionLoadDocument() function in Libxslt. This issue only affected Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. (CVE-2016-1841) It was discovered that a type confusion error existed in the xsltStylePreCompute() function in Libxslt. An attacker could use this to craft a malicious XML file that, when opened, caused a denial of service (application crash). This issue only affected Ubuntu 14.04 LTS and Ubuntu 12.04 LTS. (CVE-2015-7995) Nicolas Gregoire discovered the Libxslt mishandled the 'i' and 'a' format tokens for xsl:number data. An attacker could use this to craft a malicious document that, when opened, could cause a denial of service (application crash). This issue only affected Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. (CVE-2016-1684) It was discovered that the xsltFormatNumberConversion() function in Libxslt did not properly handle empty decimal separators. An attacker could use this to craft a malicious document that, when opened, could cause a denial of service (application crash). This issue only affected Ubuntu 16.10, Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. (CVE-2016-4738) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.04: libxslt1.1 1.1.29-2ubuntu0.1 Ubuntu 16.10: libxslt1.1 1.1.29-1ubuntu0.1 Ubuntu 16.04 LTS: libxslt1.1 1.1.28-2.1ubuntu0.1 Ubuntu 14.04 LTS: libxslt1.1 1.1.28-2ubuntu0.1 Ubuntu 12.04 LTS: libxslt1.1 1.1.26-8ubuntu1.4 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-3271-1 CVE-2015-7995, CVE-2016-1683, CVE-2016-1684, CVE-2016-1841, CVE-2016-4738, CVE-2017-5029 Package Information: https://launchpad.net/ubuntu/+source/libxslt/1.1.29-2ubuntu0.1 https://launchpad.net/ubuntu/+source/libxslt/1.1.29-1ubuntu0.1 https://launchpad.net/ubuntu/+source/libxslt/1.1.28-2.1ubuntu0.1 https://launchpad.net/ubuntu/+source/libxslt/1.1.28-2ubuntu0.1 https://launchpad.net/ubuntu/+source/libxslt/1.1.26-8ubuntu1.4 . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201804-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: libxslt: Multiple vulnerabilities Date: April 04, 2018 Bugs: #598204, #612194 ID: 201804-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities were discovered in libxslt, the worst of which may allow a remote attacker to execute arbitrary code. Background ========== libxslt is the XSLT C library developed for the GNOME project. XSLT is an XML language to define transformations for XML. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/libxslt < 1.1.30 >= 1.1.30 Description =========== Multiple vulnerabilities have been discovered in libxslt. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All libxslt users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxslt-1.1.30" References ========== [ 1 ] CVE-2016-4738 https://nvd.nist.gov/vuln/detail/CVE-2016-4738 [ 2 ] CVE-2017-5029 https://nvd.nist.gov/vuln/detail/CVE-2017-5029 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201804-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2018 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

buffer error

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

MinSik Shin,YoungJin Yoon, Gergo Koteles, Sunghyun Park, Inc,and Taekyoung Kwon of Information Security Lab, Lufeng Li of Qihoo, Dawid Czagan of Silesia Security Lab, Rodger Combs of Plex, Brandon Azad, HoJae Han, Yonsei University, Marc Heuse of mh-sec

SOURCES

LAST UPDATE DATE

2024-11-23T20:15:53.398000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE