Null pointer dereference in Libxml2 - CVE-2018-14404

Vulnerability identifier: #VU13949

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-14404

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in the xmlXPathCompOpEval() function, as defined in the path.c source code file due to improper parsing of invalid XPath expressions in the XPATH_OP_AND and XPATH_OP_OR cases. A remote attacker can send a specially crafted request that submits malicious input to an application that is using the affected library, trigger a NULL pointer dereference and cause the application to crash.

Libxml2
Amazon Linux AMI
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
cockpit-ovirt (Red Hat package)
libxml2 (Alpine package)
redhat-release-virtualization-host (Red Hat package)
libxml2 (Red Hat package)
libxml2
redhat-virtualization-host (Red Hat package)
Red Hat Virtualization Host
Red Hat Virtualization
Flex System Integrated Management Module (IMM2)
System x Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)
Integrated Management Module II (IMM2) for BladeCenter Systems
Data Computing Appliance (DCA)
IBM RackSwitch G7028
IBM RackSwitch G8052
IBM RackSwitch G8124
IBM RackSwitch G8124E

Install update from vendor's website.

cockpit-ovirt (Red Hat package) - update to 0.13.10-1.el7ev
libxml2 (Alpine package) - update to 2.9.8-r1
redhat-release-virtualization-host (Red Hat package) - update to 4.3.9-2.el7ev
Flex System Integrated Management Module (IMM2) - update to 1AOO86D-7.00
System x Integrated Management Module (IMM2) - update to 1AOO86D-7.00
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO86D-7.00-bc
Flex System Chassis Management Module (CMM) - update to 2pet18c-2.5.16c
libxml2 (Red Hat package) - addressed in versions 2.9.1-6.el7.4, 2.9.7-7.el8
libxml2 - addressed in versions 2.9.8-4.fc27, 2.9.8-4.fc28
Data Computing Appliance (DCA) - update to 4.3.0.0
redhat-virtualization-host (Red Hat package) - update to 4.3.9-20200324.0.el7_8
IBM RackSwitch G7028 - update to 7.6.8.0
IBM RackSwitch G8052 - update to 7.11.20.0
IBM RackSwitch G8124 - update to 7.11.20.0
IBM RackSwitch G8124E - update to 7.11.20.0

• Denial of service in libxml2
• Amazon Linux AMI update for libxml2
• OpenSUSE Linux update for libxml2
• OpenSUSE Linux update for libxml2
• OpenSUSE Linux update for rmt-server
• Red Hat Enterprise Linux 8 update for libxml2
• Amazon Linux AMI update for libxml2
• Null pointer dereference in libxml2 (Alpine package)
• Red Hat Virtualization Host update for cockpit-ovirt
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Red Hat Enterprise Linux 7 update for libxml2
• IBM RackSwitch firmware update for Libxml2
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• IBM Integrated Management Module II (IMM2) update for libxml2
• Fedora 27 update for libxml2
• Fedora 28 update for libxml2