Red Hat Security AdvisoryRHSA-2020:1190
libxml2 security update
Released 2020-03-31 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libxml2-2.9.1-6.el7.4, libxml2-python-2.9.1-6.el7.4
- Red Hat Enterprise Linux Client Optional (v. 7) libxml2-devel-2.9.1-6.el7.4, libxml2-static-2.9.1-6.el7.4
- Red Hat Enterprise Linux ComputeNode (v. 7) libxml2-2.9.1-6.el7.4, libxml2-python-2.9.1-6.el7.4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libxml2-devel-2.9.1-6.el7.4, libxml2-static-2.9.1-6.el7.4
- Red Hat Enterprise Linux Server (v. 7) libxml2-2.9.1-6.el7.4, libxml2-2.9.1-6.el7.4.ppc, libxml2-devel-2.9.1-6.el7.4 +2
- Red Hat Enterprise Linux Server Optional (v. 7) libxml2-static-2.9.1-6.el7.4, libxml2-static-2.9.1-6.el7.4.ppc
- Red Hat Enterprise Linux Workstation (v. 7) libxml2-2.9.1-6.el7.4, libxml2-devel-2.9.1-6.el7.4, libxml2-python-2.9.1-6.el7.4
- Red Hat Enterprise Linux Workstation Optional (v. 7) libxml2-static-2.9.1-6.el7.4
Fixes 6 records
Priority MEDIUM 44
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to t…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.02251 · Published 2016-07-23 · Partial fix CWE-416
Priority MEDIUM 43
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02938 · Published 2018-08-28 · Partial fix · 1.8.2 CWE-416
Priority LOW 36
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability…
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.04294 · Published 2018-08-16 · Partial fix CWE-835
Priority LOW 35
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.03748 · Published 2018-07-19 · Partial fix · 1.8.5 CWE-476
Priority LOW 34
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage…
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02729 · Published 2018-04-08 · Partial fix · 1.8.2 CWE-770
Priority LOW 19
The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
CVSS 2.0LOW 2.6· Network · No auth · Interaction — · EPSS 0.03261 · Published 2015-11-18 · Partial fix CWE-399
THREATIST.IORead the docs