ASA-202011-15 log generated external raw
[ASA-202011-15] libxml2: multiple issues |
---|
Arch Linux Security Advisory ASA-202011-15
==========================================
Severity: Medium
Date : 2020-11-17
CVE-ID : CVE-2019-20388 CVE-2020-7595 CVE-2020-24977
Package : libxml2
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1263
Summary
=======
The package libxml2 before version 2.9.10-6 is vulnerable to multiple
issues including denial of service and information disclosure.
Resolution
==========
Upgrade to 2.9.10-6.
# pacman -Syu "libxml2>=2.9.10-6"
The problems have been fixed upstream but no release is available yet.
Workaround
==========
None.
Description
===========
- CVE-2019-20388 (denial of service)
A memory leak was found in the xmlSchemaValidateStream function of
libxml2. Applications that use this library may be vulnerable to memory
not being freed leading to a denial of service.
- CVE-2020-7595 (denial of service)
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an
infinite loop in a certain end-of-file situation.
- CVE-2020-24977 (information disclosure)
GNOME project libxml2 <= 2.9.10 has a global buffer over-read
vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
Impact
======
A remote attacker might be able to crash an application using libxml2
or access sensitive information via a crafted XML payload.
References
==========
https://bugs.archlinux.org/task/68510
https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a
https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5
https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
https://security.archlinux.org/CVE-2019-20388
https://security.archlinux.org/CVE-2020-7595
https://security.archlinux.org/CVE-2020-24977
|