CVE-2016-4447: Apple iPhone OS

High severity, CVSS 7.5. EPSS: 14% chance of exploitation in the next 30 days.

The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.

Affected products

• Apple iPhone OS: up to and including 9.3.2
• Apple iTunes: version 12.4.1 only
• Apple Mac OS X: up to and including 10.11.5
• Apple tvOS: up to and including 9.2.1
• Apple watchOS: up to and including 2.2.1
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.10 only; version 16.04 only
• Debian Debian Linux: version 7.0 only; version 8.0 only
• HP Icewall Federation Agent: version 3.0 only
• McAfee Web Gateway: from 7.5.0.0, up to and including 7.5.2.10; from 7.6.0.0, up to and including 7.6.2.3
• Oracle Vm Server: version 3.3 only; version 3.4 only
• Xmlsoft LIBXML2: up to and including 2.9.3

Published 2016-06-09. Last modified 2026-06-17.