USN-2214-2
libxml2 regression
USN-2214-1 fixed vulnerabilities in libxml2. The upstream fix introduced a regression when using xmllint with the --postvalid option. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Daniel Berrange discovered that libxml2 would incorrectly perform entity substitution even when requested not to. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause resource consumption, resulting in a denial of service.
What each source reports
OSV No score
libxml2 regression
USN-2214-1 fixed vulnerabilities in libxml2. The upstream fix introduced a regression when using xmllint with the --postvalid option. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Daniel Berrange discovered that libxml2 would incorrectly perform entity substitution even when requested not to. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause resource consumption, resulting in a denial of service.
- Record
USN-2214-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxml2Ubuntu:14.04:LTS |
before 2.9.1+dfsg1-3ubuntu4.2, plus listed versions 2.9.1+dfsg1-3ubuntu22.9.1+dfsg1-3ubuntu32.9.1+dfsg1-3ubuntu42.9.1+dfsg1-3ubuntu4.1 |
2.9.1+dfsg1-3ubuntu4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-2214-2 is a vulnerability with no CVSS score yet in libxml2, published June 9, 2014. No source lists public exploit code. Fixed in libxml2 2.9.1+dfsg1-3ubuntu4.2.