Medium ELSA-2020-3996 3 CVEs

Moderate: libxml2 security and bug fix update (Oracle Linux 7)

Published Oct 6, 2020 · Updated Oct 6, 2020

Ecosystem: Oracle Linux

Summary

[2.9.1-6.0.1.5]
- Update doc/redhat.gif in tarball
- Add libxml2-oracle-enterprise.patch and update logos in tarball

[2.9.1-6.5]
- Fix CVE-2019-19956 (#1793000)
- Fix CVE-2019-20388 (#1810057)
- Fix CVE-2020-7595 (#1810073)
- Fix xsd:any schema validation (#1812145)

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 7	libxml2	0:2.9.1-6.0.1.el7.5
Oracle Linux · 7	libxml2-devel	0:2.9.1-6.0.1.el7.5
Oracle Linux · 7	libxml2-python	0:2.9.1-6.0.1.el7.5
Oracle Linux · 7	libxml2-static	0:2.9.1-6.0.1.el7.5

Vulnerabilities 3

High 7.5

CVE-2019-19956

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

libxml2 libxml2 libxml2 Debian Ubuntu Alpine

Dec 24, 2019
High 7.5

CVE-2019-20388

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

libxml2 libxml2 libxml2 Debian Ubuntu Alpine

Jan 21, 2020
High 7.5

CVE-2020-7595

libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

libxml2 libxml2 nokogiri libxml2 Debian Ubuntu Alpine RubyGems

Jan 21, 2020