SB2020111710 - Arch Linux update for libxml2

Description

This security bulletin contains information about 3 vulnerabilities.

1) Memory leak (CVE-ID: CVE-2019-20388)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in xmlSchemaPreRun in xmlschemas.c. A remote attacker can trigger a xmlSchemaValidateStream memory leak and perform denial of service attack.

2) Out-of-bounds read (CVE-ID: CVE-2020-24977)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the xmlEncodeEntitiesInternal() function in libxml2/entities.c in libxml2. A remote attacker can pas specially crafted XML data to the affected application, trigger out-of-bounds read error and read contents of memory on the system.

3) Infinite loop (CVE-ID: CVE-2020-7595)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in xmlStringLenDecodeEntities in parser.c. A remote attacker can consume all available system resources and cause denial of service conditions in a certain end-of-file situation.

Remediation

Install update from vendor's website.

References

• https://security.archlinux.org/advisory/ASA-202011-15