Red Hat Security Advisory: libxml2 security update

Fixed packages 20

Vulnerabilities 6

• High 8.8
  CVE-2016-5131

  Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote atta…

  chromium-browser oxide-qt libxml2 libxml2 Debian Ubuntu Alpine
  Jul 23, 2016
• High 8.8
  CVE-2017-15412

  Nokogiri gem, via libxml, is affected by DoS vulnerabilities

  Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  chromium-browser oxide-qt libxml2 libxml2 Browsers Debian Ubuntu RubyGems
  Aug 28, 2018
• Medium 6.5
  CVE-2017-18258

  Uncontrolled resource consumption in nokogiri

  The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate fi…

  libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  Apr 8, 2018
• Medium 6.5
  CVE-2018-14404

  Nokogiri NULL Pointer Dereference

  A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with th…

  libxml2 libxml2 nokogiri libxml2 Debian Ubuntu Alpine RubyGems
  Jul 19, 2018
• Unscored —
  CVE-2015-8035

  The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-de…

  libxml2 libxml2 Debian Ubuntu
  Nov 18, 2015
• Unscored —
  CVE-2018-14567

  libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a craft…

  libxml2 libxml2 libxml2 Debian Ubuntu Alpine
  Aug 16, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1277146
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1358641
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523128
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1566749
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595985
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1619875
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1190.json
• report
  https://access.redhat.com/security/cve/CVE-2015-8035
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-8035
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-8035
• report
  https://access.redhat.com/security/cve/CVE-2016-5131
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-5131
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-5131
• article
  https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html
• report
  https://access.redhat.com/security/cve/CVE-2017-15412
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15412
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15412
• article
  https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
• report
  https://access.redhat.com/security/cve/CVE-2017-18258
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-18258
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-18258
• report
  https://access.redhat.com/security/cve/CVE-2018-14404
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-14404
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-14404
• report
  https://access.redhat.com/security/cve/CVE-2018-14567
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-14567
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-14567