CVE-2020-24977

CWE-125 — Out-of-bounds ReadCWE-20 — Improper Input Validation14 documents11 sources
Severity
6.5MEDIUM
EPSS
0.5%
top 33.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
12
Oracle Mysql WorkbenchDebian Debian LinuxFedoraproject Fedora+9 more
Timeline
PublishedSep 4
Latest updateOct 15

Description

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:LExploitability: 3.9 | Impact: 2.5

Affected Packages12 packages

▶Debianlibxml2< 2.9.10+dfsg-6.2+3
▶NVDxmlsoft/libxml22.9.10
▶RubyGemsnokogiri< 1.11.4
▶NVDopensuse/leap15.1, 15.2+1

Also affects: Fedora 31, 32, 33, Debian Linux 9.0

Patches

Patch: gitlab.gnome.org ↗Patch: gitlab.gnome.org ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-w4m9-3rvp-7fhj: GNOME project libxml2 v2↗2022-05-24
▶
OSV
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12↗2021-05-17
▶
GHSA
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12↗2021-05-17
▶
OSV
CVE-2020-24977: GNOME project libxml2 v2↗2020-09-04
▶
CVEList
CVE-2020-24977: GNOME project libxml2 v2↗2020-09-03
▶

📋Vendor Advisories

6
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Web Listener (libxml2) — CVE-2020-24977↗2022-10-15
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (libxml2) — CVE-2020-24977↗2022-04-15
▶
Ubuntu
libxml2 vulnerabilities↗2021-06-17
▶
Microsoft
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.↗2020-09-08
▶
Red Hat
libxml2: Buffer overflow vulnerability in xmlEncodeEntitiesInternal() in entities.c↗2020-09-04
▶

💬Community

2
Bugzilla
CVE-2020-24977 mingw-libxml2: libxml2: Buffer Overflow vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c [fedora-all]↗2020-09-10
▶
Bugzilla
CVE-2020-24977 libxml2: Buffer overflow vulnerability in xmlEncodeEntitiesInternal() in entities.c↗2020-09-10
▶