Red Hat Security AdvisoryRHSA-2020:1827
libxml2 security update
Released 2020-04-28 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel-2.9.7-7.el8
- Red Hat Enterprise Linux BaseOS (v. 8) libxml2-2.9.7-7.el8, python3-libxml2-2.9.7-7.el8
Fixes 2 records
Priority LOW 35
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.03748 · Published 2018-07-19 · Partial fix · 1.8.5 CWE-476
Priority LOW 29
The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated b…
CVSS 3.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.02357 · Published 2018-04-04 · Fixed CWE-835
