CVE-2016-4447

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.4

Description The issue is related to the xmlParseElementDecl function in parser.c, which allows context-dependent attackers to cause a denial of service. This can be achieved through a crafted file, involving xmlParseName, and may result in a heap-based buffer underread and application crash. The vulnerability is also associated with a buffer overflow in memory.

Recommendations For versions prior to 2.9.4, update to version 2.9.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the xmlParseElementDecl function until a patch is available. Avoid using the xmlParseName function in conjunction with xmlParseElementDecl until the issue is resolved.