CVE-2019-19956

2019-12-2400:00:00

ubuntu.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.004 Low

EPSS

Percentile

74.7%

JSON

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has
a memory leak related to newDoc->oldNs.

Bugs

<https://gitlab.gnome.org/GNOME/libxml2/issues/82>

Notes

Author	Note
ccdm94	the fix for this issue, made available with commit 5a02583c, was reverted in version 2.9.11 with commit a0a8059b, since it seems like the fix introduced various memory issues in libxml2. More information regarding this choice made by upstream can be seen at: https://gitlab.gnome.org/GNOME/libxml2/-/issues/161

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlibxml2< 2.9.4+dfsg1-6.1ubuntu1.3UNKNOWN
ubuntu19.10noarchlibxml2< 2.9.4+dfsg1-7ubuntu3.1UNKNOWN
ubuntu20.04noarchlibxml2< 2.9.10+dfsg-1ubuntu2UNKNOWN
ubuntu14.04noarchlibxml2< 2.9.1+dfsg1-3ubuntu4.13+esm1UNKNOWN
ubuntu16.04noarchlibxml2< 2.9.3+dfsg1-1ubuntu0.7UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	libxml2	< 2.9.4+dfsg1-6.1ubuntu1.3	UNKNOWN
ubuntu	19.10	noarch	libxml2	< 2.9.4+dfsg1-7ubuntu3.1	UNKNOWN
ubuntu	20.04	noarch	libxml2	< 2.9.10+dfsg-1ubuntu2	UNKNOWN
ubuntu	14.04	noarch	libxml2	< 2.9.1+dfsg1-3ubuntu4.13+esm1	UNKNOWN
ubuntu	16.04	noarch	libxml2	< 2.9.3+dfsg1-1ubuntu0.7	UNKNOWN