Memory leak in Libxml2 - CVE-2019-19956

Vulnerability identifier: #VU24489

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19956

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in xmlParseBalancedChunkMemoryRecover in parser.c. A remote attacker can trigger a memory leak related to newDoc->oldNs and perform denial of service attack.

Libxml2
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
CentOS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
Opensuse
openEuler
Fedora
Ansible Automation Platform
Red Hat OpenShift Serverless
Quay
OpenShift Data Foundation (formerly OpenShift Container Storage)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
libxml2 (Alpine package)
jbcs-httpd24-mod_security (Red Hat package)
libxml2 (Ubuntu package)
libxml2 (Red Hat package)
jbcs-httpd24-curl (Red Hat package)
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
libxml2-python-debuginfo
libxml2-doc
libxml2-python-debugsource
libxml2-debugsource
libxml2-debuginfo
libxml2-32bit
libxml2-python
libxml2
mingw-libxml2
python2-libxml2
libxml2-devel
python3-libxml2
libxml2-help
IBM QRadar Network Security
Flex System Chassis Management Module (CMM)
SINEMA Remote Connect Server
Red Hat OpenShift Container Platform
IBM RackSwitch G7028
IBM RackSwitch G8124E
IBM RackSwitch G8124
IBM RackSwitch G8052

Install updates from vendor's website.

Libxml2 - update to 2.9.10
Ansible Automation Platform - addressed in versions 1.0, 1.1, 1.2.4
Red Hat OpenShift Serverless - addressed in versions 1.10.2, 1.11.0, 1.12.0
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.7-3.jbcs.el6, 1.15.7-3.jbcs.el7
jbcs-httpd24-nghttp2 (Red Hat package) - addressed in versions 1.39.2-25.jbcs.el6, 1.39.2-25.jbcs.el7
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.37-57.jbcs.el6, 2.4.37-57.jbcs.el7
libxml2 (Alpine package) - addressed in versions 2.9.8-r2, 2.9.9-r2
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.2-51.GA.jbcs.el6, 2.9.2-51.GA.jbcs.el7
libxml2 (Ubuntu package) - addressed in versions 2.9.3+dfsg1-1ubuntu0.7, 2.9.4+dfsg1-6.1ubuntu1.3, 2.9.4+dfsg1-7ubuntu3.1
libxml2 (Red Hat package) - addressed in versions 2.9.1-6.el7.5, 2.9.7-8.el8
Quay - update to 3.3.3
IBM QRadar Network Security - addressed in versions 5.4.0.13, 5.5.0.8
jbcs-httpd24-curl (Red Hat package) - addressed in versions 7.64.1-36.jbcs.el6, 7.64.1-36.jbcs.el7
jbcs-httpd24-openssl-pkcs11 (Red Hat package) - update to 0.4.10-7.jbcs.el7
Flex System Chassis Management Module (CMM) - update to 2pet22a-2.5.20a
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.0.8-24.jbcs.el6, 2.0.8-24.jbcs.el7
libxml2-python-debuginfo - update to 2.7.6-0.77.36.1
libxml2-doc - update to 2.7.6-0.77.36.1
libxml2-python-debugsource - update to 2.7.6-0.77.36.1
libxml2-debugsource - update to 2.7.6-0.77.36.1
libxml2-debuginfo - update to 2.7.6-0.77.36.1
libxml2-32bit - update to 2.7.6-0.77.36.1
libxml2-python - update to 2.7.6-0.77.36.1
libxml2 - update to 2.7.6-0.77.36.1
mingw-libxml2 - update to 2.9.10-1.fc32
libxml2 - update to 2.9.10-3.fc30
libxml2-debuginfo - update to 2.9.10-25
libxml2-debugsource - update to 2.9.10-25
python2-libxml2 - update to 2.9.10-25
libxml2 - update to 2.9.10-25
libxml2-devel - update to 2.9.10-25
python3-libxml2 - update to 2.9.10-25
libxml2-help - update to 2.9.10-25
SINEMA Remote Connect Server - update to 3.0
Red Hat OpenShift Container Platform - update to 4.3.40
IBM RackSwitch G7028 - update to 7.6.8.0
IBM RackSwitch G8124E - update to 7.11.20.0
IBM RackSwitch G8124 - update to 7.11.20.0
IBM RackSwitch G8052 - update to 7.11.20.0

• https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549
• https://lists.debian.org/debian-lts-announce/2019/12/msg00032.html
• https://security.netapp.com/advisory/ntap-20200114-0002/

• Denial of service in GNOME libxml2
• Ubuntu update for libxml2
• OpenSUSE Linux update for libxml2
• OpenSUSE Linux update for libxml2
• Red Hat update for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3
• Memory leak in libxml2 (Alpine package)
• Red Hat Enterprise Linux 7 update for libxml2
• Amazon Linux AMI update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Multiple vulnerabilities in Red Hat Openshift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat Quay
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in Siemens SINEMA Remote Connect Server
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• CentOS 7 update for libxml2
• SUSE update for libxml2
• Multiple vulnerabilities in IBM QRadar Network Security
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 1.2
• IBM RackSwitch firmware update for Libxml2
• openEuler update for libxml2
• Multiple vulnerabilities in Ansible Automation Platform 1.0 packages
• Multiple vulnerabilities in Ansible Automation Platform 1.1 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Fedora 30 update for libxml2
• Fedora 32 update for mingw-libxml2
• Multiple vulnerabilities in IBM Flex System Chassis Management Module