Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-7595: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. 1799786: CVE-2020-7595 libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations CVE-2019-20388: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability. 1799734: CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. 1788856: CVE-2019-19956 libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libxml2 | 0:2.9.1-6.amzn2.5.1 |
| Amazon Linux · 2 | libxml2-debuginfo | 0:2.9.1-6.amzn2.5.1 |
| Amazon Linux · 2 | libxml2-devel | 0:2.9.1-6.amzn2.5.1 |
| Amazon Linux · 2 | libxml2-python | 0:2.9.1-6.amzn2.5.1 |
| Amazon Linux · 2 | libxml2-static | 0:2.9.1-6.amzn2.5.1 |
Vulnerabilities 3
-
High 7.5
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
-
High 7.5
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
-
High 7.5
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.