CVE-2012-5134: Apple iPhone OS

Medium severity, CVSS 6.8. EPSS: 4.4% chance of exploitation in the next 30 days.

Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document.

Affected products

• Apple iPhone OS: up to and including 6.1.4; version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.1.0 only; version 1.1.1 only; …
• Google Chrome: up to and including 23.0.1271.89; version 23.0.1271.0 only; version 23.0.1271.1 only; version 23.0.1271.2 only; version 23.0.1271.3 only; version 23.0.1271.4 only; …
• Xmlsoft LIBXML2: up to and including 2.9.0; version 1.7.0 only; version 1.7.1 only; version 1.7.2 only; version 1.7.3 only; version 1.7.4 only; …

Published 2012-11-28. Last modified 2026-06-16.