CVE-2018-9251

The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
Affected Products (NVD)
VendorProductVersion
xmlsoftlibxml2
2.9.8
debiandebian_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libxml2
bookworm
2.9.14+dfsg-1.3~deb12u1
fixed
bullseye
2.9.10+dfsg-6.7+deb11u4
fixed
bullseye (security)
2.9.10+dfsg-6.7+deb11u5
fixed
sid
2.12.7+dfsg+really2.9.14-0.1
fixed
trixie
2.12.7+dfsg+really2.9.14-0.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libxml2
artful
not-affected
trusty
not-affected
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libxml2-2
suse enterprise desktop 15
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP1
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP2
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP3
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise desktop 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise desktop 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise sap 12 SP3
2.9.4-46.15.1
fixed
suse enterprise sap 12 SP5
2.9.4-46.20.1
fixed
suse enterprise sap 15
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP1
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP2
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP3
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise sap 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise server 12 SP3
2.9.4-46.15.1
fixed
suse enterprise server 12 SP5
2.9.4-46.20.1
fixed
suse enterprise server 15
2.9.7-3.3.1
fixed
suse enterprise server 15 SP1
2.9.7-3.3.1
fixed
suse enterprise server 15 SP2
2.9.7-3.3.1
fixed
suse enterprise server 15 SP3
2.9.7-3.3.1
fixed
suse enterprise server 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise server 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.2.1
fixed
libxml2-2-32bit
suse enterprise desktop 15
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP1
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP2
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP3
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise desktop 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise desktop 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise sap 12 SP3
2.9.4-46.15.1
fixed
suse enterprise sap 12 SP5
2.9.4-46.20.1
fixed
suse enterprise sap 15
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP1
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP2
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP3
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise sap 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise server 12 SP3
2.9.4-46.15.1
fixed
suse enterprise server 12 SP5
2.9.4-46.20.1
fixed
suse enterprise server 15
2.9.7-3.3.1
fixed
suse enterprise server 15 SP1
2.9.7-3.3.1
fixed
suse enterprise server 15 SP2
2.9.7-3.3.1
fixed
suse enterprise server 15 SP3
2.9.7-3.3.1
fixed
suse enterprise server 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise server 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.2.1
fixed
libxml2-devel
suse enterprise desktop 15
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP1
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP2
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP3
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise desktop 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise desktop 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise sap 15
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP1
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP2
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP3
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise sap 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise server 15
2.9.7-3.3.1
fixed
suse enterprise server 15 SP1
2.9.7-3.3.1
fixed
suse enterprise server 15 SP2
2.9.7-3.3.1
fixed
suse enterprise server 15 SP3
2.9.7-3.3.1
fixed
suse enterprise server 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise server 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.2.1
fixed
libxml2-doc
suse enterprise sap 12 SP3
2.9.4-46.15.1
fixed
suse enterprise sap 12 SP5
2.9.4-46.20.1
fixed
suse enterprise server 12 SP3
2.9.4-46.15.1
fixed
suse enterprise server 12 SP5
2.9.4-46.20.1
fixed
libxml2-tools
suse enterprise desktop 15
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP1
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP2
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP3
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise desktop 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise desktop 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise sap 12 SP3
2.9.4-46.15.1
fixed
suse enterprise sap 12 SP5
2.9.4-46.20.1
fixed
suse enterprise sap 15
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP1
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP2
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP3
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise sap 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise server 12 SP3
2.9.4-46.15.1
fixed
suse enterprise server 12 SP5
2.9.4-46.20.1
fixed
suse enterprise server 15
2.9.7-3.3.1
fixed
suse enterprise server 15 SP1
2.9.7-3.3.1
fixed
suse enterprise server 15 SP2
2.9.7-3.3.1
fixed
suse enterprise server 15 SP3
2.9.7-3.3.1
fixed
suse enterprise server 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise server 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.2.1
fixed
python-libxml2
suse enterprise sap 12 SP3
2.9.4-46.15.1
fixed
suse enterprise server 12 SP3
2.9.4-46.15.1
fixed
python2-libxml2-python
suse enterprise desktop 15
2.9.7-3.3.1
fixed
suse enterprise sap 15
2.9.7-3.3.1
fixed
suse enterprise server 15
2.9.7-3.3.1
fixed
python3-libxml2
suse enterprise desktop 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise desktop 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise desktop 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise sap 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise sap 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.2.1
fixed
suse enterprise server 15 SP4
2.9.12-150400.3.4
fixed
suse enterprise server 15 SP5
2.10.3-150500.3.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.14.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.2.1
fixed
python3-libxml2-python
suse enterprise desktop 15
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP1
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP2
2.9.7-3.3.1
fixed
suse enterprise desktop 15 SP3
2.9.7-3.3.1
fixed
suse enterprise sap 15
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP1
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP2
2.9.7-3.3.1
fixed
suse enterprise sap 15 SP3
2.9.7-3.3.1
fixed
suse enterprise server 15
2.9.7-3.3.1
fixed
suse enterprise server 15 SP1
2.9.7-3.3.1
fixed
suse enterprise server 15 SP2
2.9.7-3.3.1
fixed
suse enterprise server 15 SP3
2.9.7-3.3.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libxml2
RHEL 8
0:2.9.7-7.el8
fixed
libxml2-devel
RHEL 8
0:2.9.7-7.el8
fixed
python3-libxml2
RHEL 8
0:2.9.7-7.el8
fixed
Common Weakness Enumeration
References
https://bugzilla.gnome.org/show_bug.cgi?id=794914
https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html
https://bugzilla.gnome.org/show_bug.cgi?id=794914
https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html