Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2016-1683

25
FAUCET Score

CVE-2016-1683 is a high-severity vulnerability in libxslt versions prior to 1.1.29, notably affecting Google Chrome before 51.0.2704.63, as well as various Linux distributions. It stems from improper handling of namespace nodes, allowing remote attackers to trigger a denial of service via out-of-bounds heap memory access with a crafted document, potentially leading to further unspecified impacts. The attack requires user interaction (e.g., opening a malicious document) and has high impacts on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or significant community discussion, though it was mentioned in a SecurityWeek article regarding Chrome 51 patches.

Impacted Technologies

VendorProductVersion(s)CPE
<= 1.1.28CPE matchmatch criteria
cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:*
14.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
15.10CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
16.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.6
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
2.14%
Probability of exploitation in next 30 days
EPSS Percentile
80.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0214 is in the 53rd percentile among its peer group of 1,571 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.2 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.6 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (9)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6 SupplementaryFixed in: chromium-browser-0:51.0.2704.63-1.el6
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: libxslt
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: libxslt
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: libxslt
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux OpenStack Platform 6 (Juno)Fixed in: libxslt
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)Fixed in: libxslt
redhatend of lifevia redhat_api
Product: Red Hat Gluster Storage 3.1Fixed in: libxslt
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 8 (Liberty)Fixed in: libxslt
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 9 (Mitaka)Fixed in: libxslt

Vendor Advisories (1)

redhatCVE-2016-1683Moderate

chromium-browser: out-of-bounds access in libxslt

May 25, 2016

References

googlechromereleases.blogspot.com / 2016/05/stable-channel-update_25.html
lists.apple.com / archives/security-announce/2016/Jul/msg00000.html
lists.apple.com / archives/security-announce/2016/Jul/msg00001.html
lists.apple.com / archives/security-announce/2016/Jul/msg00002.html
lists.apple.com / archives/security-announce/2016/Jul/msg00003.html
lists.apple.com / archives/security-announce/2016/Jul/msg00005.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00062.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00063.html
lists.opensuse.org / opensuse-security-announce/2016-06/msg00005.html
access.redhat.com / errata/RHSA-2016:1190
bugzilla.redhat.com / show_bug.cgi
crbug.com / 583156
git.gnome.org / browse/libxslt/commit
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA
security.gentoo.org / glsa/201607-07
support.apple.com / HT206899
support.apple.com / HT206901
support.apple.com / HT206902
support.apple.com / HT206903
support.apple.com / HT206904
support.apple.com / HT206905
debian.org / security/2016/dsa-3590
debian.org / security/2016/dsa-3605
securityfocus.com / bid/90876
securityfocus.com / bid/91826
securitytracker.com / id/1035981
ubuntu.com / usn/USN-2992-1