Denial of service in GNOME libxml2

1) Infinite loop

EUVDB-ID: #VU14470

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14567

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in the liblzma error code of the GNOME libxml2 library due to an infinite loop condition in the Lempel–Ziv–Markov (LZMA) decompression feature during the processing of XML files. A remote attacker can trick the victim into opening an XML file that submits malicious input, trigger a LZMA_MEMLIMIT_ERROR condition and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Libxml2: 2.9.8

External links

http://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.