CVE-2018-14567: Medium severity Xmlsoft Libxml2 vulnerability
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libxml2to a version that resolves this vulnerability.Fixed in 0:2.9.1-6.el7.4 - Upgrade
Upgrade
redhat/libxml2to a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
debian/libxml2to a version that resolves this vulnerability.Fixed in 2.9.14+dfsg-1.3~deb12u6Fixed in 2.9.14+dfsg-1.3~deb12u4Fixed in 2.12.7+dfsg+really2.9.14-2.1+deb13u3Fixed in 2.12.7+dfsg+really2.9.14-2.1+deb13u1Fixed in 2.15.4+dfsg-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for libxml2?
The vulnerability ID for libxml2 is CVE-2018-14567.
What is the severity of CVE-2018-14567?
The severity of CVE-2018-14567 is medium.
How does CVE-2018-14567 affect libxml2?
CVE-2018-14567 allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR.
How can I fix CVE-2018-14567?
To fix CVE-2018-14567, you should update the libxml2 package to version 2.9.9 or higher.
Where can I find more information about CVE-2018-14567?
You can find more information about CVE-2018-14567 at the following references: [MITRE] [Ubuntu Security Notice] [NVD].