libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

🗓️ 24 Feb 2020 19:12:36Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 111 Views

libxml2 infinite loop patched in Nokogir

Reporter	Title	Published	Views	Family All 213
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance is affected by libxml2 vulnerabilities (CVE-2019-19956, CVE-2019-20388, CVE-2020-7595)	20 Jan 202112:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	15 Apr 202221:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM RackSwitch firmware products are affected by vulnerabilities in Libxml2	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities.	19 Jul 202221:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in Libxml2	11 Mar 202119:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Bootable Media Creator (BoMC) is affected by vulnerabilities in libxml2	21 Jun 202120:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in Libxml2	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202100:04	–	ibm
ALT Linux	Security fix for the ALT Linux 9 package libxml2 version 1:2.9.10-alt4	9 Nov 202000:00	–	altlinux

Vulners

Node

nokogiri nokogiriRange<1.10.8rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-7595
github	www.github.com/sparklemotion/nokogiri/issues/1992
gitlab	www.gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/
usn	www.usn.ubuntu.com/4274-1/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/
lists	www.lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html
security	www.security.netapp.com/advisory/ntap-20200702-0005/
oracle	www.oracle.com/security-alerts/cpujul2020.html

09 Jun 2023 20:02Current

1.8Low risk

Vulners AI Score1.8

CVSS 25

CVSS 3.17.5

EPSS0.07836

SSVC