Red Hat Security Advisory

RHSA-2020:3996

libxml2 security and bug fix update

Released 2020-09-29 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) libxml2-2.9.1-6.el7.5, libxml2-python-2.9.1-6.el7.5
Red Hat Enterprise Linux Client Optional (v. 7) libxml2-devel-2.9.1-6.el7.5, libxml2-static-2.9.1-6.el7.5
Red Hat Enterprise Linux ComputeNode (v. 7) libxml2-2.9.1-6.el7.5, libxml2-python-2.9.1-6.el7.5
Red Hat Enterprise Linux ComputeNode Optional (v. 7) libxml2-devel-2.9.1-6.el7.5, libxml2-static-2.9.1-6.el7.5
Red Hat Enterprise Linux Server (v. 7) libxml2-2.9.1-6.el7.5, libxml2-2.9.1-6.el7.5.ppc, libxml2-devel-2.9.1-6.el7.5 +2
Red Hat Enterprise Linux Server Optional (v. 7) libxml2-static-2.9.1-6.el7.5, libxml2-static-2.9.1-6.el7.5.ppc
Red Hat Enterprise Linux Workstation (v. 7) libxml2-2.9.1-6.el7.5, libxml2-devel-2.9.1-6.el7.5, libxml2-python-2.9.1-6.el7.5
Red Hat Enterprise Linux Workstation Optional (v. 7) libxml2-static-2.9.1-6.el7.5

TI-2020-06117 CVE-2020-7595 · GHSA-7553-jr98-vx47

HIGH 74

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07836 Published 2020-01-21 Partial fix · 1.10.8 CWE-835

TI-2019-14394 CVE-2019-19956 · GHSA-5cvc-j2xm-h554

MEDIUM 47

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05626 Published 2019-12-24 Partial fix CWE-772

TI-2019-14622 CVE-2019-20388 · GHSA-7g45-9xmp-g2w6

MEDIUM 45

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03183 Published 2020-01-21 Partial fix CWE-401