CVE-2016-4607

libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4608, CVE-2016-4609, CVE-2016-4610, and CVE-2016-4612.

Initial assessment incorrectly noted RHEL8 as being affected, due to the lack of detail in all available reports, including upstream. Apple’s advisory provided no usable or meaningful information. Further investigation determined that upstream corrected this in version 1.1.29, via one of a number of security-relevant commits that did not disclose CVE names. RHEL 8.0 shipped with libxslt 1.1.32, which included all of these patches. The CVE page has been updated to reflect that RHEL 8 is in fact not affected.

Red Hat OpenStack will consume fixes from the base Red Hat Enterprise Linux Operating System. Therefore the package provided by Red Hat OpenStack has been marked as will not fix.

Red Hat Product Security could not determine whether Red Hat Enterprise Linux is affected by this flaw due to lack of information on the flaw. Therefore this issue is being marked as won't fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.