Ubuntu update for libxml2

Published: 2020-02-10 | Updated: 2023-04-12

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2020-7595 CVE-2019-19956
CWE-ID	CWE-835 CWE-401
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	libxml2 (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Infinite loop

EUVDB-ID: #VU24488

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-7595

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in xmlStringLenDecodeEntities in parser.c. A remote attacker can consume all available system resources and cause denial of service conditions in a certain end-of-file situation.

Mitigation

Update the affected packages.

Ubuntu 19.10: libxml2 - 2.9.4+dfsg1-7ubuntu3.1; libxml2-utils - 2.9.4+dfsg1-7ubuntu3.1
Ubuntu 18.04 LTS: libxml2 - 2.9.4+dfsg1-6.1ubuntu1.3; libxml2-utils - 2.9.4+dfsg1-6.1ubuntu1.3
Ubuntu 16.04 LTS: libxml2 - 2.9.3+dfsg1-1ubuntu0.7; libxml2-utils - 2.9.3+dfsg1-1ubuntu0.7
Ubuntu 14.04 ESM: libxml2 - 2.9.1+dfsg1-3ubuntu4.13+esm1; libxml2-utils - 2.9.1+dfsg1-3ubuntu4.13+esm1
Ubuntu 12.04 ESM: libxml2 - 2.7.8.dfsg-5.1ubuntu4.22; libxml2-utils - 2.7.8.dfsg-5.1ubuntu4.22

Vulnerable software versions

libxml2 (Ubuntu package): 2.9.3+dfsg1-1ubuntu0.1 - 2.9.4+dfsg1-7ubuntu3

CPE2.3

External links

http://usn.ubuntu.com/4274-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU24489