CVE-2016-4483: Debian Linux

High severity, CVSS 7.5. EPSS: 6.2% chance of exploitation in the next 30 days.

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.

Affected products

• Debian Debian Linux: version 8.0 only
• Oracle Solaris: version 11.3 only
• Xmlsoft LIBXML2: before 2.9.4 (fixed in 2.9.4)

Published 2017-04-11. Last modified 2026-06-17.