PT-2016-2793 · Apple+2 · Libxslt+6

Nick Wellnhofer · Published 2016-09-25 · Updated 2026-03-13 · CVE-2016-4738

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libxslt in Apple iOS versions prior to 10 libxslt in Apple OS X versions prior to 10.12 libxslt in Apple tvOS versions prior to 10 libxslt in Apple watchOS versions prior to 3

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted web site. This is caused by a buffer overflow in the libxslt component of the operating systems, which can be exploited by a remote attacker using a specially formed web site.

Recommendations For libxslt in Apple iOS versions prior to 10, update to iOS 10 or later. For libxslt in Apple OS X versions prior to 10.12, update to OS X 10.12 or later. For libxslt in Apple tvOS versions prior to 10, update to tvOS 10 or later. For libxslt in Apple watchOS versions prior to 3, update to watchOS 3 or later.

Fix

DoS

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2016-02196

CVE-2016-4738

DLA-700-1

DSA-3709-1

MGASA-2016-0394

OPENSUSE-SU-2024:11017-1

OPENSUSE-SU-2024:11340-1

OPENSUSE-SU-2024:11912-1

OPENSUSE-SU-2024:13165-1

OPENSUSE-SU-2024:14174-1

OPENSUSE-SU-2025:14697-1

OPENSUSE-SU-2026:10356-1

SUSE-SU-2017:1282-1

SUSE-SU-2017:1313-1

USN-3271-1

Affected Products

Os X

Suse

Ubuntu

Ios

Libxslt

Tvos

Watchos

References · 96

• https://osv.dev/vulnerability/DSA-3709-1 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14174-1 · Vendor Advisory
• https://support.apple.com/HT207142 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10356-1 · Vendor Advisory
• https://support.apple.com/HT207141 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14697-1 · Vendor Advisory
• https://support.apple.com/HT207170 · Vendor Advisory
• http://debian.org/security/2016/dsa-3709 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4738 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4738 · Security Note
• https://debian.org/security/2016/dsa-3709 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4738 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11912-1 · Vendor Advisory