Skip to content
OpenAdvisories
Medium ELSA-2020-1827 2 CVEs

Moderate: libxml2 security update (Oracle Linux 8)

Published May 5, 2020 · Updated May 5, 2020

Ecosystem: Oracle Linux

Summary

[2.9.7-7.0.1]
- Update doc/redhat.gif in tarball
- Add libxml2-oracle-enterprise.patch and update logos in tarball

[2.9.7-7]
- Fix CVE-2018-14404 (#1595989)

[2.9.7-6]
- Fix CVE-2018-9251 (#1565322)

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 libxml2 0:2.9.7-7.0.1.el8
Oracle Linux · 8 libxml2-devel 0:2.9.7-7.0.1.el8
Oracle Linux · 8 python3-libxml2 0:2.9.7-7.0.1.el8

Vulnerabilities 2

  • Medium 6.5
    CVE-2018-14404

    Nokogiri NULL Pointer Dereference

    A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with th…

    libxml2 libxml2 nokogiri libxml2 Debian Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2018-9251

    The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial o…

    libxml2 Alpine