CVE-2016-2073

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-bounds read) via a crafted XML document.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/01/25/6Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/26/7Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
http://www.securityfocus.com/bid/85267Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035011Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2994-1Third Party Advisory
https://security.gentoo.org/glsa/201701-37Third Party Advisory
https://www.debian.org/security/2016/dsa-3593Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/25/6Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/26/7Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
http://www.securityfocus.com/bid/85267Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035011Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2994-1Third Party Advisory
https://security.gentoo.org/glsa/201701-37Third Party Advisory
https://www.debian.org/security/2016/dsa-3593Third Party Advisory

Timeline

Published: Feb 12, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-20749.8Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to CVE-2016-20755.4Cross-site scripting (XSS) vulnerability in VMware vRealize Business Advanced and Enterprise 8.x before 8.2.5 on Linux allows remote authent CVE-2016-20767.6Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automa CVE-2016-20779.8VMware Workstation 11.x before 11.1.3 and VMware Player 7.x before 7.1.3 on Windows incorrectly access an executable file, which allows host CVE-2016-20786.1Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 befo CVE-2016-20795.9VMware NSX Edge 6.1 before 6.1.7 and 6.2 before 6.2.3 and vCNS Edge 5.5 before 5.5.4.3, when the SSL-VPN feature is configured, allow remote CVE-2016-20816.1Cross-site scripting (XSS) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to inject arbitrary CVE-2016-20828.8Cross-site request forgery (CSRF) vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.3.2 allows remote attackers to hijack th CVE-2016-20847.4F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.18 CVE-2016-20855.5The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it CVE-2016-20867.5Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request CVE-2016-20877.4Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot