CVE-2016-4658
1 advisory.
RubyGems/nokogiri CVE-2016-4658: critical 9.8, EPSS 8.56%
Nokogiri does not forbid namespace nodes in XPointer ranges
Action: Upgrade nokogiri to 1.7.1 or later.
bundle update nokogiriAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.7.1 | - |
Fixed versions
| 1.7.1 |
Sources
- osv: GHSA-fr52-4hqw-p27f
- https://nvd.nist.gov/vuln/detail/CVE-2016-4658
- https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b
- https://security.gentoo.org/glsa/201701-37
- https://support.apple.com/HT207141
- https://support.apple.com/HT207142
- https://support.apple.com/HT207143
- https://support.apple.com/HT207170
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE-2016-4658 · published · modified · JSON