Memory leak in Libxml2 - CVE-2019-20388

Vulnerability identifier: #VU24487

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-20388

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in xmlSchemaPreRun in xmlschemas.c. A remote attacker can trigger a xmlSchemaValidateStream memory leak and perform denial of service attack.

Libxml2
Arch Linux
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
CentOS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
Ubuntu
Opensuse
Fedora
cflinuxfs3
APM Edge
Ansible Automation Platform
Red Hat OpenShift Serverless
Quay
OpenShift Data Foundation (formerly OpenShift Container Storage)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
libxml2 (Alpine package)
jbcs-httpd24-mod_security (Red Hat package)
libxml2 (Red Hat package)
jbcs-httpd24-curl (Red Hat package)
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
libxml2-python-debugsource
libxml2-python-debuginfo
libxml2-debuginfo
libxml2-32bit
libxml2-debugsource
libxml2-python
libxml2-doc
libxml2
libxml2 (Ubuntu package)
libxml2-utils (Ubuntu package)
python3-libxml2
libxml2-devel
mingw-libxml2
IBM QRadar Network Security
Flex System Chassis Management Module (CMM)
Red Hat OpenShift Container Platform
IBM RackSwitch G7028
IBM RackSwitch G8124E
IBM RackSwitch G8124
IBM RackSwitch G8052

Install update from vendor's website.

cflinuxfs3 - update to 0.245.0
APM Edge - update to 4.0
Ansible Automation Platform - addressed in versions 1.0, 1.1, 1.2.4
Red Hat OpenShift Serverless - addressed in versions 1.10.2, 1.11.0, 1.12.0
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.7-3.jbcs.el6, 1.15.7-3.jbcs.el7
jbcs-httpd24-nghttp2 (Red Hat package) - addressed in versions 1.39.2-25.jbcs.el6, 1.39.2-25.jbcs.el7
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.37-57.jbcs.el6, 2.4.37-57.jbcs.el7
libxml2 (Alpine package) - update to 2.9.10-r3
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.2-51.GA.jbcs.el6, 2.9.2-51.GA.jbcs.el7
libxml2 (Red Hat package) - addressed in versions 2.9.1-6.el7.5, 2.9.7-8.el8
Quay - update to 3.3.3
IBM QRadar Network Security - addressed in versions 5.4.0.13, 5.5.0.8
jbcs-httpd24-curl (Red Hat package) - addressed in versions 7.64.1-36.jbcs.el6, 7.64.1-36.jbcs.el7
jbcs-httpd24-openssl-pkcs11 (Red Hat package) - update to 0.4.10-7.jbcs.el7
Flex System Chassis Management Module (CMM) - update to 2pet22a-2.5.20a
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.0.8-24.jbcs.el6, 2.0.8-24.jbcs.el7
libxml2-python-debugsource - update to 2.7.6-0.77.36.1
libxml2-python-debuginfo - update to 2.7.6-0.77.36.1
libxml2-debuginfo - update to 2.7.6-0.77.36.1
libxml2-32bit - update to 2.7.6-0.77.36.1
libxml2-debugsource - update to 2.7.6-0.77.36.1
libxml2-python - update to 2.7.6-0.77.36.1
libxml2-doc - update to 2.7.6-0.77.36.1
libxml2 - update to 2.7.6-0.77.36.1
libxml2 (Ubuntu package) - addressed in versions 2.9.4+dfsg1-6.1ubuntu1.4, 2.9.10+dfsg-6.3ubuntu0.1, 2.9.10+dfsg-5ubuntu0.20.04.1, 2.9.10+dfsg-5ubuntu0.20.10.2
libxml2-utils (Ubuntu package) - addressed in versions 2.9.4+dfsg1-6.1ubuntu1.4, 2.9.10+dfsg-6.3ubuntu0.1, 2.9.10+dfsg-5ubuntu0.20.04.1, 2.9.10+dfsg-5ubuntu0.20.10.2
python3-libxml2 - update to 2.9.7-9.0.1
libxml2-devel - update to 2.9.7-9.0.1
libxml2 - update to 2.9.7-9.0.1
mingw-libxml2 - update to 2.9.10-1.fc32
libxml2 - addressed in versions 2.9.10-3.fc30, 2.9.10-3.fc31
Red Hat OpenShift Container Platform - update to 4.3.40
IBM RackSwitch G7028 - update to 7.6.8.0
IBM RackSwitch G8124E - update to 7.11.20.0
IBM RackSwitch G8124 - update to 7.11.20.0
IBM RackSwitch G8052 - update to 7.11.20.0

• https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68

• Multiple vulnerabilities in Gnome libxml2
• OpenSUSE Linux update for libxml2
• Red Hat update for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3
• Memory leak in libxml2 (Alpine package)
• Red Hat Enterprise Linux 7 update for libxml2
• Gentoo update for libxml2
• Amazon Linux AMI update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Arch Linux update for libxml2
• Arch Linux update for libxml2
• Multiple vulnerabilities in Red Hat Openshift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat Quay
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in cflinuxfs3
• CentOS 7 update for libxml2
• Multiple vulnerabilities in Hitachi Energy APM Edge
• SUSE update for libxml2
• Ubuntu update for libxml2
• Multiple vulnerabilities in IBM QRadar Network Security
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 1.2
• IBM RackSwitch firmware update for Libxml2
• Anolis OS update for libxml2
• Multiple vulnerabilities in Ansible Automation Platform 1.0 packages
• Multiple vulnerabilities in Ansible Automation Platform 1.1 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Fedora 31 update for libxml2
• Fedora 30 update for libxml2
• Fedora 32 update for mingw-libxml2
• Multiple vulnerabilities in IBM Flex System Chassis Management Module