GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00502.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Debian
  • Debian Linux
Fedoraproject
  • Fedora
Netapp
  • Active Iq Unified Manager
  • Clustered Data Ontap
  • Clustered Data Ontap Antivirus Connector
  • Hci H410c
  • Hci H410c Firmware
  • Inventory Collect Tool
  • Manageability Software Development Kit
  • Snapdrive
Opensuse
  • Leap
Oracle
  • Communications Cloud Native Core Network Function Cloud Native Environment
  • Enterprise Manager Base Platform
  • Enterprise Manager Ops Center
  • Http Server
  • Mysql Workbench
  • Peoplesoft Enterprise Peopletools
  • Real User Experience Insight
Redhat
  • Enterprise Linux
Xmlsoft
  • Libxml2

Configuration 1 [-]

cpe:2.3:a:xmlsoft:libxml2:2.9.10:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

Configuration 5 [-]

OR cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:inventory_collect_tool:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:unix:*:*
cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:*

Configuration 6 [-]

AND
cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:*

Configuration 7 [-]

OR cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
libxml2-0:2.9.7-9.el8 cpe:/a:redhat:enterprise_linux:8 RHSA-2021:1597 2021-05-18T00:00:00Z
libxml2-0:2.9.7-9.el8 cpe:/o:redhat:enterprise_linux:8 RHSA-2021:1597 2021-05-18T00:00:00Z

No data.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-2369-1 libxml2 security update
EUVD EUVD EUVD-2020-17677 GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
Ubuntu USN Ubuntu USN USN-4991-1 libxml2 vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html cve-icon cve-icon
https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2 cve-icon cve-icon
https://gitlab.gnome.org/GNOME/libxml2/-/issues/178 cve-icon cve-icon
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KTUAGDLEHTH6HU66HBFAFTSQ3OKRAN3/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/674LQPJO2P2XTBTREFR5LOZMBTZ4PZAY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENEHQIBMSI6TZVS35Y6I4FCTYUQDLJVP/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3ICASXZI2UQYFJAOQWHSTNWGED3VXOE/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCHXIWR5DHYO3RSO7RAHEC6VJKXD2EH2/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7MEWYKIKMV2SKMGH4IDWVU3ZGJXBCPQ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RIQAMBA2IJUTQG5VOP5LZVIZRNCKXHEQ/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-24977 cve-icon
https://security.gentoo.org/glsa/202107-05 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20200924-0001/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-24977 cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-04T15:26:08.992Z

Reserved: 2020-08-28T00:00:00

Link: CVE-2020-24977

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-09-04T00:15:10.693

Modified: 2024-11-21T05:16:15.740

Link: CVE-2020-24977

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-09-04T00:00:00Z

Links: CVE-2020-24977 - Bugzilla

cve-icon OpenCVE Enrichment

No data.