Arch Linux Security Advisory ASA-202011-15 ========================================== Severity: Medium Date : 2020-11-17 CVE-ID : CVE-2019-20388 CVE-2020-7595 CVE-2020-24977 Package : libxml2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1263 Summary ======= The package libxml2 before version 2.9.10-6 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 2.9.10-6. # pacman -Syu "libxml2>=2.9.10-6" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2019-20388 (denial of service) A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. - CVE-2020-7595 (denial of service) xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. - CVE-2020-24977 (information disclosure) GNOME project libxml2 <= 2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. Impact ====== A remote attacker might be able to crash an application using libxml2 or access sensitive information via a crafted XML payload. References ========== https://bugs.archlinux.org/task/68510 https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314... https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d98... https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca0... https://security.archlinux.org/CVE-2019-20388 https://security.archlinux.org/CVE-2020-7595 https://security.archlinux.org/CVE-2020-24977