Denial of Service Vulnerability in libxml2 by GNOME
CVE-2018-14567

6.5MEDIUM

Key Information:

Vendor

Xmlsoft

Status
Libxml2
Vendor
CVE Published:
16 August 2018

What is CVE-2018-14567?

An issue in libxml2 allows remote attackers to trigger an infinite loop by crafting a specific XML file that invokes LZMA_MEMLIMIT_ERROR when the configuration flag --with-lzma is used. This can lead to service disruption as demonstrated by xmllint, marking it as a distinct vulnerability from previous CVEs.

References

http://www.securityfocus.com/bid/105198
vdb-entryx_refsource_BID
https://lists.debian.org/debian-lts-announce/2018/09/msg0...
mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3739-1/
vendor-advisoryx_refsource_UBUNTU

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.