CVE-2016-3627

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.9.3 and earlier

Description The issue is related to the xmlStringGetNodeList function in tree.c of the libxml2 library. It is caused by uncontrolled recursion when the function is used in recovery mode. This allows attackers to cause a denial of service, including infinite recursion, stack consumption, and application crash, by using a specially crafted XML document. There is no information about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations For libxml2 versions 2.9.3 and earlier, as a temporary workaround, consider disabling the xmlStringGetNodeList function when used in recovery mode until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.