CVE-2016-5131

Summary

CVECVE-2016-5131
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2016-07-23 19:59:00 UTC
Updated2023-11-07 02:32:00 UTC
DescriptionUse-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.

Risk And Classification

Problem Types: CWE-416

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Apple Iphone Os All All All All
Operating System Apple Iphone Os All All All All
Operating System Apple Mac Os X All All All All
Operating System Apple Mac Os X All All All All
Operating System Apple Tvos All All All All
Operating System Apple Tvos All All All All
Operating System Apple Watchos All All All All
Operating System Apple Watchos All All All All
Operating System Canonical Ubuntu Linux 14.04 All All All
Operating System Canonical Ubuntu Linux 16.04 All All All
Operating System Canonical Ubuntu Linux 14.04 All All All
Operating System Canonical Ubuntu Linux 16.04 All All All
Operating System Debian Debian Linux 8.0 All All All
Operating System Debian Debian Linux 9.0 All All All
Operating System Debian Debian Linux 8.0 All All All
Operating System Debian Debian Linux 9.0 All All All
Application Google Chrome All All All All
Application Google Chrome All All All All
Operating System Opensuse Leap 42.1 All All All
Operating System Opensuse Leap 42.1 All All All
Operating System Opensuse Opensuse 13.1 All All All
Operating System Opensuse Opensuse 13.2 All All All
Operating System Opensuse Opensuse 13.1 All All All
Operating System Opensuse Opensuse 13.2 All All All
Operating System Redhat Enterprise Linux Desktop 6.0 All All All
Operating System Redhat Enterprise Linux Desktop 6.0 All All All
Operating System Redhat Enterprise Linux Server 6.0 All All All
Operating System Redhat Enterprise Linux Server 6.0 All All All
Operating System Redhat Enterprise Linux Workstation 6.0 All All All
Operating System Redhat Enterprise Linux Workstation 6.0 All All All
Operating System Suse Linux Enterprise 12.0 All All All
Operating System Suse Linux Enterprise 12.0 All All All
Application Xmlsoft Libxml2 All All All All

References

ReferenceSourceLinkTags
[security-announce] openSUSE-SU-2016:1869-1: important: Security update SUSE lists.opensuse.org Mailing List, Third Party Advisory
APPLE-SA-2016-09-20-3 iOS 10 lists.apple.com
Issue 2127493002: Delete obsolete XPointer range-to function. - Code Review codereview.chromium.org
Android Security Bulletin—May 2017  |  Android Open Source Project source.android.com
Chromium: Multiple vulnerabilities (GLSA 201610-09) — Gentoo security security.gentoo.org
About the security content of macOS Sierra 10.12 - Apple Support support.apple.com
About the security content of watchOS 3 - Apple Support CONFIRM support.apple.com Third Party Advisory
About the security content of tvOS 10 - Apple Support support.apple.com
Google Android Multiple Flaws Let Remote Users Deny Service, Obtain Potentially Sensitive Information, and Execute Arbitrary Code and Let Local Apps Gain Elevated Privileges - SecurityTracker SECTRACK www.securitytracker.com Third Party Advisory, VDB Entry
APPLE-SA-2016-09-20 macOS Sierra 10.12 APPLE lists.apple.com Mailing List, Third Party Advisory
[security-announce] openSUSE-SU-2016:1918-1: important: Security update SUSE lists.opensuse.org Mailing List, Third Party Advisory
USN-3041-1: Oxide vulnerabilities | Ubuntu UBUNTU www.ubuntu.com Third Party Advisory
Google Chrome Multiple Flaws Lets Remote Users Bypass Same-Origin Restrictions, Obtain Potentially Sensitive Information, Spoof URLs, and Execute Arbitrary Code - SecurityTracker www.securitytracker.com
Red Hat Customer Portal REDHAT rhn.redhat.com Third Party Advisory
[security-announce] openSUSE-SU-2016:1868-1: important: Security update SUSE lists.opensuse.org Mailing List, Third Party Advisory
APPLE-SA-2016-09-20-5 watchOS 3 lists.apple.com
Google Chrome Prior to 52.0.2743.82 Multiple Security Vulnerabilities BID www.securityfocus.com Third Party Advisory, VDB Entry
[security-announce] openSUSE-SU-2016:1865-1: important: Security update lists.opensuse.org
APPLE-SA-2016-09-20-6 tvOS 10 APPLE lists.apple.com Mailing List, Third Party Advisory
Debian -- Security Information -- DSA-3637-1 chromium-browser DEBIAN www.debian.org Third Party Advisory
libxml2: Multiple vulnerabilities (GLSA 201701-37) — Gentoo security GENTOO security.gentoo.org Third Party Advisory
623378 - chromium - An open-source project to help move the web forward. - Monorail CONFIRM crbug.com Exploit, Issue Tracking, Mailing List, Vendor Advisory
Bug 1358641 – CVE-2016-5131 chromium-browser: use-after-free in libxml bugzilla.redhat.com
About the security content of iOS 10 - Apple Support support.apple.com
Chrome Releases: Stable Channel Update googlechromereleases.blogspot.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 377223 Alibaba Cloud Linux Security Update for libxml2 (ALINUX2-SA-2020:0077)
  • 500346 Alpine Linux Security Update for libxml2
  • 504109 Alpine Linux Security Update for libxml2
  • 591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report