RHSA-2020:4479: Moderate: libxml2 security update
The libxml2 library is a development toolbox providing the implementation of various XML standards.Security Fix(es): libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c (CVE-2019-19956) libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c (CVE-2019-20388) libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations (CVE-2020-7595) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libxml2to a version that resolves this vulnerability.Fixed in 2.9.7-8.el8 - Upgrade
Upgrade
redhat/libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 2.9.7-8.el8 - Upgrade
Upgrade
redhat/libxml2-debugsourceto a version that resolves this vulnerability.Fixed in 2.9.7-8.el8 - Upgrade
Upgrade
redhat/libxml2-develto a version that resolves this vulnerability.Fixed in 2.9.7-8.el8 - Upgrade
Upgrade
redhat/python3-libxml2to a version that resolves this vulnerability.Fixed in 2.9.7-8.el8 - Upgrade
Upgrade
redhat/python3-libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 2.9.7-8.el8 - Upgrade
Upgrade
redhat/libxml2to a version that resolves this vulnerability.Fixed in 2.9.7-8.el8.aa - Upgrade
Upgrade
redhat/libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 2.9.7-8.el8.aa - Upgrade
Upgrade
redhat/libxml2-debugsourceto a version that resolves this vulnerability.Fixed in 2.9.7-8.el8.aa - Upgrade
Upgrade
redhat/libxml2-develto a version that resolves this vulnerability.Fixed in 2.9.7-8.el8.aa - Upgrade
Upgrade
redhat/python3-libxml2to a version that resolves this vulnerability.Fixed in 2.9.7-8.el8.aa - Upgrade
Upgrade
redhat/python3-libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 2.9.7-8.el8.aa - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Patch CVE-2020-7595 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Patch CVE-2019-20388 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Patch CVE-2019-19956 - Operational
Restart the desktop after applying the libxml2 security update (log out, then log back in) for the update to take effect.
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:4479?
The severity of RHSA-2020:4479 is classified as important due to the memory leak vulnerabilities found.
How do I fix RHSA-2020:4479?
To fix RHSA-2020:4479, update the libxml2 package to version 2.9.7-8.el8 or later.
What components are affected by RHSA-2020:4479?
The affected components include libxml2, libxml2-debuginfo, libxml2-devel, python3-libxml2, and their corresponding debug packages.
What vulnerabilities are addressed in RHSA-2020:4479?
RHSA-2020:4479 addresses memory leak vulnerabilities in xmlParseBalancedChunkMemoryRecover and xmlSchemaPreRun.
Is RHSA-2020:4479 specific to certain operating systems?
Yes, RHSA-2020:4479 is specific to Red Hat Enterprise Linux version 8.