CVE-2019-20388

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
VendorProductVersion
xmlsoftlibxml2
2.9.10
debiandebian_linux
9.0
netappcloud_backup
-
netappclustered_data_ontap
-
netappontap_select_deploy_administration_utility
-
netappplug-in_for_symantec_netbackup
-
netappsmi-s_provider
-
netappsnapdrive
-
netappsteelstore_cloud_integrated_storage
-
netapph300s_firmware
-
netapph500s_firmware
-
netapph700s_firmware
-
netapph300e_firmware
-
netapph500e_firmware
-
netapph700e_firmware
-
netapph410s_firmware
-
oraclecommunications_cloud_native_core_network_function_cloud_native_environment
1.10.0
oracleenterprise_manager_base_platform
13.4.0.0
oracleenterprise_manager_base_platform
13.5.0.0
oracleenterprise_manager_ops_center
12.4.0.0
oraclemysql_workbench
𝑥
≤ 8.0.26
oraclepeoplesoft_enterprise_peopletools
8.58
oraclereal_user_experience_insight
13.3.1.0
oraclereal_user_experience_insight
13.4.1.0
oraclereal_user_experience_insight
13.5.1.0
opensuseleap
15.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libxml2
bullseye
2.9.10+dfsg-6.7+deb11u4
fixed
jessie
no-dsa
bullseye (security)
2.9.10+dfsg-6.7+deb11u5
fixed
bookworm
2.9.14+dfsg-1.3~deb12u1
fixed
sid
2.12.7+dfsg+really2.9.14-0.1
fixed
trixie
2.12.7+dfsg+really2.9.14-0.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libxml2
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
eoan
ignored
bionic
Fixed 2.9.4+dfsg1-6.1ubuntu1.4
released
xenial
Fixed 2.9.3+dfsg1-1ubuntu0.7+esm1
released
trusty
Fixed 2.9.1+dfsg1-3ubuntu4.13+esm2
released
References