製品・ソフトウェアに関する情報

JVN脆弱性詳細

libxml2 におけるフォーマットストリングの脆弱性

Title	libxml2 におけるフォーマットストリングの脆弱性
Summary	libxml2 には、フォーマットストリングの脆弱性が存在します。
Possible impacts	攻撃者により、フォーマットストリング指定子を介して、不特定の影響を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 23, 2016, midnight
Registration Date	June 14, 2016, 4:05 p.m.
Last Update	Nov. 16, 2016, 6:13 p.m.

CVSS3.0 : 緊急
Score	9.8
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS2.0 : 危険
Score	10
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected System

レッドハット

Red Hat Enterprise Linux 5

Red Hat Enterprise Linux 6

Red Hat Enterprise Linux 7

Red Hat JBoss Web Server 3.0

オラクル

Oracle VM サーバー

IBM

IBM Lotus Protector for Mail Security 2.8.0.0 から 2.8.1.0

アップル

Apple Mac OS X 10.10.5

Apple Mac OS X 10.11.6 未満の 10.11

Apple Mac OS X 10.9.5

iCloud 5.2.1 未満 (Windows 7 以降)

iOS 9.3.3 未満 (iPad 2 以降)

iOS 9.3.3 未満 (iPhone 4s 以降)

iOS 9.3.3 未満 (iPod touch 第 5 世代以降)

iTunes 12.4.2 未満 (Windows 7 以降)

tvOS 9.2.2 未満 (Apple TV 第 4 世代)

watchOS 2.2.2 未満 (Apple Watch Edition)

watchOS 2.2.2 未満 (Apple Watch Hermes)

watchOS 2.2.2 未満 (Apple Watch Sport)

watchOS 2.2.2 未満 (Apple Watch)

xmlsoft.org

libxml2 2.9.4 未満

SUSE

SUSE Linux Enterprise Debuginfo 11-SP2

SUSE Linux Enterprise Debuginfo 11-SP3

SUSE Linux Enterprise Debuginfo 11-SP4

SUSE Linux Enterprise Desktop 12

SUSE Linux Enterprise Desktop 12-SP1

SUSE Linux Enterprise Server 11-SP2-LTSS

SUSE Linux Enterprise Server 11-SP3-LTSS

SUSE Linux Enterprise Server 11-SP4

SUSE Linux Enterprise Server 12

SUSE Linux Enterprise Server 12-SP1

SUSE Linux Enterprise Software Development Kit 11-SP4

SUSE Linux Enterprise Software Development Kit 12

SUSE Linux Enterprise Software Development Kit 12-SP1

SUSE Manager 2.1

SUSE Manager Proxy 2.1

SUSE OpenStack Cloud 5

openSUSE project

openSUSE Leap 42.1

Slackware

Slackware Linux 14.0

Slackware Linux 14.1

ヒューレット・パッカード・エンタープライズ

IceWall Federation Agent 3.0 (RHEL 6/7)

Mageia.Org

Mageia 5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-4448	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4448
National Vulnerability Database (NVD)
2	CVE-2016-4448	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4448
Red Hat
3	CVE-2016-4448	https://access.redhat.com/security/cve/CVE-2016-4448
SUSE Security Update
4	CVE-2016-4448	https://www.suse.com/security/cve/CVE-2016-4448

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Apple Mailing Lists
1	APPLE-SA-2016-07-18-1 OS X El Capitan v10.11.6 and Security Update 2016-004	http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
2	APPLE-SA-2016-07-18-2 iOS 9.3.3	http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
3	APPLE-SA-2016-07-18-3 watchOS 2.2.2	http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
4	APPLE-SA-2016-07-18-4 tvOS 9.2.2	http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
5	APPLE-SA-2016-07-18-6 iTunes 12.4.2	http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
Apple Security Updates
6	HT206899	https://support.apple.com/en-us/HT206899
7	HT206901	https://support.apple.com/en-us/HT206901
8	HT206902	https://support.apple.com/en-us/HT206902
9	HT206903	https://support.apple.com/en-us/HT206903
10	HT206904	https://support.apple.com/en-us/HT206904
11	HT206905	https://support.apple.com/en-us/HT206905
Apple セキュリティアップデート
12	HT206899	https://support.apple.com/ja-jp/HT206899
13	HT206901	https://support.apple.com/ja-jp/HT206901
14	HT206902	https://support.apple.com/ja-jp/HT206902
15	HT206903	https://support.apple.com/ja-jp/HT206903
16	HT206904	https://support.apple.com/ja-jp/HT206904
17	HT206905	https://support.apple.com/ja-jp/HT206905
Bugzilla
18	Bug 981549	https://bugzilla.suse.com/show_bug.cgi?id=981549
GNOME GIT REPOSITORY
19	Fix some format string warnings with possible format string vulnerability	https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9
20	More format string warnings with possible format string vulnerability	https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
HPE Security Bulletin
21	HPSBGN03628	https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05194709
IBM Support Document
22	1986391	https://www-01.ibm.com/support/docview.wss?uid=swg21986391
Mageia Advisory
23	MGASA-2016-0263	http://advisories.mageia.org/MGASA-2016-0263.html
opensuse-security-announce
24	openSUSE-SU-2016:1595	https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
25	SUSE-SU-2016:1538	https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00012.html
26	SUSE-SU-2016:1604	https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00029.html
Oracle Technology Network
27	Oracle Linux Bulletin - July 2016	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
28	Oracle Solaris Third Party Bulletin - July 2016	http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
29	Oracle VM Server for x86 Bulletin - July 2016	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Red Hat Bugzilla
30	Bug 1338700	https://bugzilla.redhat.com/show_bug.cgi?id=1338700
Red Hat Security Advisory
31	RHSA-2016:1292	https://access.redhat.com/errata/RHSA-2016:1292
Slackware Security Advisories
32	[slackware-security] libxml2 (SSA:2016-148-01)	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
Turbolinux Security Advisory
33	TLSA-2016-22	http://www.turbolinux.co.jp/security/2016/TLSA-2016-22j.html
xmlsoft.org news
34	2.9.4: May 23 2016	http://xmlsoft.org/news.html

その他

No	Name	URL
JVN
1	JVNVU#94844193	http://jvn.jp/vu/JVNVU94844193/index.html

Change Log

No	Changed Details	Date of change
0	[2016年06月14日] 掲載 [2016年08月03日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (HT206899) を追加ベンダ情報：アップル (HT206901) を追加ベンダ情報：アップル (HT206905) を追加ベンダ情報：アップル (HT206904) を追加ベンダ情報：アップル (HT206902) を追加ベンダ情報：アップル (HT206903) を追加ベンダ情報：アップル (APPLE-SA-2016-07-18-6 iTunes 12.4.2) を追加ベンダ情報：アップル (APPLE-SA-2016-07-18-4 tvOS 9.2.2) を追加ベンダ情報：アップル (APPLE-SA-2016-07-18-3 watchOS 2.2.2) を追加ベンダ情報：アップル (APPLE-SA-2016-07-18-2 iOS 9.3.3) を追加ベンダ情報：アップル (APPLE-SA-2016-07-18-1 OS X El Capitan v10.11.6 and Security Update 2016-004) を追加参考情報：JVN (JVNVU#94844193) を追加 [2016年09月06日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：IBM (1986391) を追加ベンダ情報：Mageia.Org (MGASA-2016-0263) を追加ベンダ情報：SUSE (Bug 981549) を追加ベンダ情報：SUSE (CVE-2016-4448) を追加ベンダ情報：Slackware ([slackware-security] libxml2 (SSA:2016-148-01)) を追加ベンダ情報：openSUSE project (SUSE-SU-2016:1538) を追加ベンダ情報：openSUSE project (SUSE-SU-2016:1604) を追加ベンダ情報：openSUSE project (openSUSE-SU-2016:1595) を追加ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBGN03628) を追加ベンダ情報：レッドハット (CVE-2016-4448) を追加ベンダ情報：レッドハット (RHSA-2016:1292) を追加 [2016年10月27日] ベンダ情報：ターボリナックス (TLSA-2016-22) を追加 [2016年11月16日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Linux Bulletin - July 2016) を追加ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - July 2016) を追加ベンダ情報：オラクル (Oracle VM Server for x86 Bulletin - July 2016) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-4448

Summary	Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
Publication Date	June 10, 2016, 1:59 a.m.
Registration Date	Jan. 26, 2021, 2:12 p.m.
Last Update	Nov. 21, 2024, 11:52 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:hp:icewall_federation_agent:3.0:::::::*
execution environment
1	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
2	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:apple:watchos::::::::			2.2.1

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:apple:mac_os_x::::::::					10.11.6

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:xmlsoft:libxml2::::::::			2.9.3

Configuration5		or higher	or less	more than	less than
cpe:2.3:a:apple:icloud::::::::					5.2.1
execution environment
1	cpe:2.3:o:microsoft:windows:-:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:o:apple:iphone_os::::::::			9.3.2

Configuration7	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:::::::*

Configuration8		or higher	or less	more than	less than
cpe:2.3:a:apple:itunes::::::::			12.4.1
execution environment
1	cpe:2.3:o:microsoft:windows::::::::

Configuration9	or higher	or less	more than	less than
cpe:2.3:o:slackware:slackware_linux:14.1:::::::*
cpe:2.3:o:slackware:slackware_linux:14.0:::::::*

Configuration10	or higher	or less	more than	less than
cpe:2.3:o:oracle:vm_server:3.4:::::::*
cpe:2.3:o:oracle:vm_server:3.3:::::::*

Configuration11		or higher	or less	more than	less than
cpe:2.3:o:apple:tvos::::::::			9.2.1

Configuration12		or higher	or less	more than	less than
cpe:2.3:a:tenable:log_correlation_engine:4.8.0:::::::*

Configuration13	or higher	or less	more than	less than
cpe:2.3:a:mcafee:web_gateway::::::::		7.5.2.10
cpe:2.3:a:mcafee:web_gateway::::::::	7.6.0.0	7.6.2.3

Configuration14	or higher	or less	more than	less than
cpe:2.3:o:oracle:linux:7:0::::::
cpe:2.3:o:oracle:linux:6:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html	Mailing List Release Notes
2	http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html	Mailing List Release Notes
3	http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html	Mailing List Release Notes
4	http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html	Mailing List Release Notes
5	http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html	Mailing List Release Notes
6	http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html	Mailing List Release Notes
7	http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html	Mailing List Release Notes
8	http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html	Mailing List Release Notes
9	http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html	Mailing List Release Notes
10	http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html	Mailing List Release Notes
11	http://rhn.redhat.com/errata/RHSA-2016-2957.html	Third Party Advisory
12	http://rhn.redhat.com/errata/RHSA-2016-2957.html	Third Party Advisory
13	http://www.openwall.com/lists/oss-security/2016/05/25/2	Mailing List Third Party Advisory
14	http://www.openwall.com/lists/oss-security/2016/05/25/2	Mailing List Third Party Advisory
15	http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html	Third Party Advisory
16	http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html	Third Party Advisory
17	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html	Third Party Advisory
18	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html	Third Party Advisory
19	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	Vendor Advisory
20	http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html	Vendor Advisory
21	http://www.securityfocus.com/bid/90856	Third Party Advisory VDB Entry
22	http://www.securityfocus.com/bid/90856	Third Party Advisory VDB Entry
23	http://www.securitytracker.com/id/1036348	Third Party Advisory VDB Entry
24	http://www.securitytracker.com/id/1036348	Third Party Advisory VDB Entry
25	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722	Third Party Advisory
26	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722	Third Party Advisory
27	http://xmlsoft.org/news.html	Release Notes
28	http://xmlsoft.org/news.html	Release Notes
29	https://access.redhat.com/errata/RHSA-2016:1292	Third Party Advisory
30	https://access.redhat.com/errata/RHSA-2016:1292	Third Party Advisory
31	https://bugzilla.redhat.com/show_bug.cgi?id=1338700	Issue Tracking Third Party Advisory
32	https://bugzilla.redhat.com/show_bug.cgi?id=1338700	Issue Tracking Third Party Advisory
33	https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9	Vendor Advisory
34	https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9	Vendor Advisory
35	https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b	Vendor Advisory
36	https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b	Vendor Advisory
37	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709	Third Party Advisory
38	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709	Third Party Advisory
39	https://kc.mcafee.com/corporate/index?page=content&id=SB10170	Third Party Advisory
40	https://kc.mcafee.com/corporate/index?page=content&id=SB10170	Third Party Advisory
41	https://support.apple.com/HT206899	Release Notes
42	https://support.apple.com/HT206899	Release Notes
43	https://support.apple.com/HT206901	Release Notes
44	https://support.apple.com/HT206901	Release Notes
45	https://support.apple.com/HT206902	Release Notes
46	https://support.apple.com/HT206902	Release Notes
47	https://support.apple.com/HT206903	Release Notes
48	https://support.apple.com/HT206903	Release Notes
49	https://support.apple.com/HT206904	Release Notes
50	https://support.apple.com/HT206904	Release Notes
51	https://support.apple.com/HT206905	Release Notes
52	https://support.apple.com/HT206905	Release Notes
53	https://www.tenable.com/security/tns-2016-18	Third Party Advisory
54	https://www.tenable.com/security/tns-2016-18	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-134	書式文字列の問題	https://cwe.mitre.org/data/definitions/134.html

Configuration7	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:::::::*