Lucene search

K
centosCentOS ProjectCESA-2020:1190
HistoryApr 08, 2020 - 6:42 p.m.

libxml2 security update

2020-04-0818:42:56
CentOS Project
lists.centos.org
169

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.106 Low

EPSS

Percentile

94.9%

CentOS Errata and Security Advisory CESA-2020:1190

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

  • libxml2: Use after free triggered by XPointer paths beginning with range-to (CVE-2016-5131)

  • libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c (CVE-2017-15412)

  • libxml2: DoS caused by incorrect error detection during XZ decompression (CVE-2015-8035)

  • libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)

  • libxml2: Unrestricted memory usage in xz_head() function in xzlib.c (CVE-2017-18258)

  • libxml2: Infinite loop caused by incorrect error detection during LZMA decompression (CVE-2018-14567)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032588.html

Affected packages:
libxml2
libxml2-devel
libxml2-python
libxml2-static

Upstream details at:
https://access.redhat.com/errata/RHSA-2020:1190

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.106 Low

EPSS

Percentile

94.9%

Related for CESA-2020:1190