ALINUX2-SA-2020%3A0149

ALINUX2-SA-2020%3A0149 PUBLISHED CVSS 7.5 HIGH

Package updates are available for Alibaba Cloud Linux 2.1903 that fix the following vulnerabilities: CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. CVE-2019-20388: xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. CVE-2020-7595: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Alibaba Cloud	libxml2

Timeline

Oct 11, 2020 CVE Published
Oct 11, 2020 CVE Updated

References

ALINUX2-SA-2020:0149: libxml2 security and bug fix update (Moderate) advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19956 advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20388 advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7595 advisory

Open in Interactive Console →