High SSA-292794 2 CVEs

SSA-292794: Multiple Denial-of-Service Vulnerabilities in SINEMA Remote Connect Server

Published Apr 13, 2021 · Updated Apr 13, 2021

Vendor: Siemens Product: SINEMA Remote Connect Server

Summary

The latest update for SINEMA Remote Connect Server fixes two Denial-of-Service vulnerabilities in the underlying third-party XML parser.

Siemens has released updates for the affected product and recommends to update to the latest versions.

Vulnerabilities 2

High 7.5

CVE-2019-19956

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

libxml2 libxml2 libxml2 Debian Ubuntu Alpine

Dec 24, 2019
High 7.5

CVE-2020-7595

libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

libxml2 libxml2 nokogiri libxml2 Debian Ubuntu Alpine RubyGems

Jan 21, 2020

Revision history

2021-04-13 #1
Publication Date

References

SSA-292794: Multiple Denial-of-Service Vulnerabilities in SINEMA Remote Connect Server - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf
SSA-292794: Multiple Denial-of-Service Vulnerabilities in SINEMA Remote Connect Server - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-292794.txt