Skip to content
OpenAdvisories
Medium ALAS2-2020-1534 3 CVEs

Moderate: libxml2 security update (Amazon Linux 2)

Published Oct 22, 2020 · Updated Oct 22, 2020

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-7595: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. 1799786: CVE-2020-7595 libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations CVE-2019-20388: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability. 1799734: CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. 1788856: CVE-2019-19956 libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libxml2 0:2.9.1-6.amzn2.5.1
Amazon Linux · 2 libxml2-debuginfo 0:2.9.1-6.amzn2.5.1
Amazon Linux · 2 libxml2-devel 0:2.9.1-6.amzn2.5.1
Amazon Linux · 2 libxml2-python 0:2.9.1-6.amzn2.5.1
Amazon Linux · 2 libxml2-static 0:2.9.1-6.amzn2.5.1

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-19956.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-20388.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-7595.html