Integer overflow in Libxml2 - CVE-2020-27911
Published: November 6, 2020 / Updated: May 14, 2021
Vulnerability identifier: #VU48188
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-27911
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow when processing XML data in libxml2. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Libxml2
watchOS
macOS
tvOS
iPadOS
Apple iOS
watchOS
macOS
tvOS
iPadOS
Apple iOS
How to mitigate CVE-2020-27911
Install update from vendor's website.
Libxml2 - update to 2.9.11
watchOS - update to 7.1 18R590
tvOS - update to 14.2 18K57
iPadOS - update to 14.2 18B92
Apple iOS - update to 14.2 18B92
watchOS - update to 7.1 18R590
tvOS - update to 14.2 18K57
iPadOS - update to 14.2 18B92
Apple iOS - update to 14.2 18B92