VDB
CISA-2018-14404
CISA-2018-14404
PUBLISHED
CVSS 6.5 MEDIUM
Reported by mitre · Published July 19, 2018
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | n/a, n/a |
Timeline
- Jul 19, 2018 CVE Published
- Dec 3, 2025 CVE Updated
- Mar 26, 2026 Distribution Patch
- Mar 26, 2026 Security Advisory
References
- [debian-lts-announce] 20180927 [SECURITY] [DLA 1524-1] libxml2 security update mailing-listx_refsource_MLIST
- x_refsource_MISC
- USN-3739-1 vendor-advisoryx_refsource_UBUNTU
- x_refsource_MISC
- USN-3739-2 vendor-advisoryx_refsource_UBUNTU
- x_refsource_MISC
- RHSA-2019:1543 vendor-advisoryx_refsource_REDHAT
- x_refsource_CONFIRM
- [debian-lts-announce] 20200909 [SECURITY] [DLA 2369-1] libxml2 security update mailing-listx_refsource_MLIST