CVE-2018-14567: Medium severity Xmlsoft Libxml2 vulnerability
Last updated 25 August 2025
Other sources
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libxml2to a version that resolves this vulnerability.Fixed in 0:2.9.1-6.el7.4 - Upgrade
Upgrade
debian/libxml2to a version that resolves this vulnerability.Fixed in 2.9.10+dfsg-6.7+deb11u4Fixed in 2.9.10+dfsg-6.7+deb11u9Fixed in 2.9.14+dfsg-1.3~deb12u5Fixed in 2.9.14+dfsg-1.3~deb12u4Fixed in 2.12.7+dfsg+really2.9.14-2.1+deb13u2Fixed in 2.12.7+dfsg+really2.9.14-2.1+deb13u1Fixed in 2.15.1+dfsg-2 - Upgrade
Upgrade
redhat/libxml2to a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.9.8Patch 2240fbf5912054af025fb6e01e26375100275e74
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for libxml2?
The vulnerability ID for libxml2 is CVE-2018-14567.
What is the severity of CVE-2018-14567?
The severity of CVE-2018-14567 is medium.
How does CVE-2018-14567 affect libxml2?
CVE-2018-14567 allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR.
How can I fix CVE-2018-14567?
To fix CVE-2018-14567, you should update the libxml2 package to version 2.9.9 or higher.
Where can I find more information about CVE-2018-14567?
You can find more information about CVE-2018-14567 at the following references: [MITRE] [Ubuntu Security Notice] [NVD].