{"id":"CVE-2018-14404","aliases":["ALPINE-CVE-2018-14404","BELL-CVE-2018-14404","CLSA-2026-1777464764","CLSA-2026-1777878328","DEBIAN-CVE-2018-14404","DLA-1524-1","DLA-2369-1","EUVD-2019-0178","GHSA-6qvp-r6r3-9p7h","MGASA-2019-0047","RHBA-2020:1310","RHSA-2020:1190","RHSA-2020:1827","SUSE-SU-2018:3080-1","SUSE-SU-2018:3081-1","SUSE-SU-2019:0272-1","SUSE-SU-2019:13985-1","UBUNTU-CVE-2018-14404","USN-3739-1","openSUSE-SU-2019:0185-1","openSUSE-SU-2024:10589-1","openSUSE-SU-2024:11016-1","openSUSE-SU-2024:11340-1","openSUSE-SU-2024:11912-1","openSUSE-SU-2024:13165-1","openSUSE-SU-2024:14174-1","openSUSE-SU-2025:14697-1","openSUSE-SU-2026:10356-1"],"status":"published","title":"Nokogiri NULL Pointer Dereference","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03748,"percentile":0.89949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-07-19T00:00:00Z","modified":"2026-10-24T10:47:37Z","fixes":[{"ecosystem":"RubyGems","package":"nokogiri","fixed_in":["1.8.5"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.10","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"cockpit-ovirt","fixed_in":["0:0.13.10-1.el7ev"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"cockpit-ovirt-dashboard","fixed_in":["0:0.13.10-1.el7ev"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host","fixed_in":["0:4.3.9-20200324.0.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update","fixed_in":["0:4.3.9-20200324.0.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-release-virtualization-host","fixed_in":["0:4.3.9-2.el7ev"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update-placeholder","fixed_in":["0:4.3.9-2.el7ev"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","fixed_in":["2.9.1+dfsg1-3ubuntu4.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.el6_8.1.tuxcare.els14"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.el6_8.1.tuxcare.els14"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.el6_8.1.tuxcare.els14"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.el6_8.1.tuxcare.els14"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.0.1.el6_8.1.tuxcare.ol.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.0.1.el6_8.1.tuxcare.ol.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.0.1.el6_8.1.tuxcare.ol.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-21.0.1.el6_8.1.tuxcare.ol.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-5+deb8u7"}]}],"versions":["2.9.1+dfsg1-5","2.9.1+dfsg1-5+deb8u1","2.9.1+dfsg1-5+deb8u2","2.9.1+dfsg1-5+deb8u3","2.9.1+dfsg1-5+deb8u4","2.9.1+dfsg1-5+deb8u5","2.9.1+dfsg1-5+deb8u6"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-2.2+deb9u3"}]}],"versions":["2.9.4+dfsg1-2.2","2.9.4+dfsg1-2.2+deb9u1","2.9.4+dfsg1-2.2+deb9u2"],"bundled":8},{"source":"osv","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4"]},{"source":"osv","ecosystem":"Mageia:6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"perl-XML-LibXML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.200-1.1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"cockpit-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.10-1.el7ev"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"cockpit-ovirt-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.10-1.el7ev"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.9-20200324.0.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.9-20200324.0.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-release-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.9-2.el7ev"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update-placeholder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.9-2.el7ev"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.77.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.6"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.2"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.6"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.2"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.13-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.12-1.2"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3-1.1"}]}],"bundled":35},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.9-1.7"}]}],"bundled":41},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.5-1.5"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.2-1.1"}]}],"bundled":44},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.9-1.4"}]}],"bundled":44}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/issues/10","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/3739-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/3739-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595985","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1543","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190719-0002/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14404","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/issues/1785","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-14404.yml","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190719-0002","tags":["web"]},{"url":"https://usn.ubuntu.com/3739-1","tags":["web"]},{"url":"https://usn.ubuntu.com/3739-2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6qvp-r6r3-9p7h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-14404","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-14404","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1777464764.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1777878328.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-14404","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0047.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23410","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/G5AFZARX7BUSU24J2MJ4AHX5OE47UXQA/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2020:1310","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1796967","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1804999","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1814137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1814193","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_1310.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14404","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1190","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1277146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1358641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1523128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1619875","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1190.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8035","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5131","tags":["advisory"]},{"url":"https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15412","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15412","tags":["advisory"]},{"url":"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18258","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14567","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14567","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1827","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1565318","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1827.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-9251","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-9251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9251","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1088279","tags":["report"]},{"url":"https://bugzilla.suse.com/1102046","tags":["report"]},{"url":"https://bugzilla.suse.com/1105166","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9251","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183081-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1088601","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18258","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190272-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1102193","tags":["report"]},{"url":"https://bugzilla.suse.com/1109307","tags":["report"]},{"url":"https://bugzilla.suse.com/1113760","tags":["report"]},{"url":"https://bugzilla.suse.com/1113969","tags":["report"]},{"url":"https://bugzilla.suse.com/1114831","tags":["report"]},{"url":"https://bugzilla.suse.com/1117106","tags":["report"]},{"url":"https://bugzilla.suse.com/1118579","tags":["report"]},{"url":"https://bugzilla.suse.com/1118584","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16470","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913985-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1010675","tags":["report"]},{"url":"https://bugzilla.suse.com/1110146","tags":["report"]},{"url":"https://bugzilla.suse.com/1126613","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9318","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-14404","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3739-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3739-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14567","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AV7P2XPVE2GW6NK2J7LPNFK4M3HRKL2B/#AV7P2XPVE2GW6NK2J7LPNFK4M3HRKL2B","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-25032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29469","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U5YNW74OL2W7SH2XTAVN5TODNFIVFL3Y/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-14404","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","status":"published","published":"2018-07-19T13:00:00Z","modified":"2026-10-14T06:30:36.17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:35:00.948726Z"}],"euvd":[{"id":"EUVD-2019-0178","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","status":"published","published":"2018-07-19T13:00:00Z","modified":"2026-10-14T06:30:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:17.902641Z"}],"ghsa":[{"id":"GHSA-6qvp-r6r3-9p7h","title":"Nokogiri NULL Pointer Dereference","description":"A NULL pointer dereference vulnerability exists in the `xpath.c:xmlXPathCompOpEval()` function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the `XPATH_OP_AND` or `XPATH_OP_OR` case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","status":"published","published":"2019-01-17T14:05:03Z","modified":"2025-12-04T16:20:46Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:39:11.110487Z"}],"nvd":[{"id":"CVE-2018-14404","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","status":"published","published":"2018-07-19T13:29:00.48Z","modified":"2026-10-14T07:16:42.14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:33.865124Z"}],"osv":[{"id":"ALPINE-CVE-2018-14404","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","status":"published","published":"2018-07-19T13:29:00.48Z","modified":"2026-10-23T17:17:55.213316956Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-14404","title":"CVE-2018-14404 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:57.404432Z","modified":"2026-01-26T09:47:10.598533Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-14404","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","status":"published","published":"2018-07-19T13:29:00.48Z","modified":"2026-10-24T10:47:37.698857068Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-14404","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","status":"published","published":"2018-07-19T13:29:00.48Z","modified":"2026-10-15T07:47:35.084332463Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"GHSA-6qvp-r6r3-9p7h","title":"Nokogiri NULL Pointer Dereference","description":"A NULL pointer dereference vulnerability exists in the `xpath.c:xmlXPathCompOpEval()` function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the `XPATH_OP_AND` or `XPATH_OP_OR` case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","status":"published","published":"2019-01-17T14:05:03Z","modified":"2025-12-05T12:28:29.328953Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"RHBA-2020:1310","title":"Red Hat Bug Fix Advisory: Red Hat Virtualization Host (redhat-virtualization-host) 4.3.9 async","status":"published","published":"2024-09-13T16:48:41Z","modified":"2026-09-21T10:02:28Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2020:1190","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2024-09-16T03:18:57Z","modified":"2026-10-14T10:01:18Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1827","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2024-09-16T03:15:14Z","modified":"2026-09-21T10:02:35Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2018-14404","description":"A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","status":"published","published":"2018-07-19T00:00:00Z","modified":"2026-04-22T11:45:12.424561Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"CLSA-2026-1777464764","title":"libxml2: Fix of 2 CVEs","description":"- CVE-2018-14404: fix NULL pointer dereference in xmlXPathCompOpEval when\n  AND/OR operator operates on an empty XPath stack\n- CVE-2019-19956: fix memory leak in xmlParseBalancedChunkMemoryRecover when\n  parsing NULL doc","status":"published","published":"2026-05-02T00:55:05Z","modified":"2026-06-01T00:33:17.002506069Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777878328","title":"libxml2: Fix of 2 CVEs","description":"- CVE-2018-14404: fix NULL pointer dereference in xmlXPathCompOpEval when\n  parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case\n- CVE-2019-19956: fix memory leak in xmlParseBalancedChunkMemoryRecover related\n  to newDoc-\u003eoldNs","status":"published","published":"2026-05-04T07:05:33Z","modified":"2026-06-01T00:33:25.933012232Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DLA-1524-1","title":"libxml2 - security update","status":"published","published":"2018-09-27T00:00:00Z","modified":"2026-03-09T01:21:54.21619Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2369-1","title":"libxml2 - security update","status":"published","published":"2020-09-09T00:00:00Z","modified":"2026-03-09T01:23:38.236188Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2019-0047","title":"Updated libxml2 packages fix security vulnerabilities","description":"A flaw was found in libxml2 2.9.8. The xz_decomp function in xzlib.c, if\n--with-lzma is used, allows remote attackers to cause a denial of service\n(infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR,\nas demonstrated by xmllint (CVE-2018-9251, CVE-2018-14567).\n\nA null pointer dereference vulnerability exists in the\nxpath.c:xmlXPathCompOpEval() function of libxml2 when parsing invalid\nXPath expression. Applications processing untrusted XSL format inputs\nwith the use of libxml2 library may be vulnerable to denial of service\nattack due to crash of the application (CVE-2018-14404).\n\nThe libxml2 package has been updated to version 2.9.9 to fix these\nissues and other bugs.\n\nThe perl-XML-LibXML package has been rebuilt against the updated libxml2.\n","status":"published","published":"2019-01-23T15:50:09Z","modified":"2026-04-16T06:23:30.519837644Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0185-1","title":"Security update for rmt-server","description":"This update for rmt-server to version 1.1.1 fixes the following issues:\n\nThe following issues have been fixed:\n\n- Fixed migration problems which caused some extensions / modules to be dropped (bsc#1118584, bsc#1118579)\n- Fixed listing of mirrored products (bsc#1102193)\n- Include online migration paths into offline migration (bsc#1117106)\n- Sync products that do not have a base product (bsc#1109307)\n- Fixed SLP auto discovery for RMT (bsc#1113760)\n\nUpdate dependencies for security fixes:\n\n- CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969)\n- CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831)\n- CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T10:59:47Z","modified":"2026-02-04T03:16:41.366486Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10589-1","title":"rmt-server-2.6.13-1.1 on GA media","description":"These are all security issues fixed in the rmt-server-2.6.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:48.695963Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:11016-1","title":"libxml2-2-2.9.12-1.2 on GA media","description":"These are all security issues fixed in the libxml2-2-2.9.12-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:05.061414Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11340-1","title":"ruby2.7-rubygem-nokogiri-1.12.3-1.2 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-nokogiri-1.12.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:48:20.265892Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11912-1","title":"ruby3.1-rubygem-nokogiri-1.13.3-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:50:48.204593Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:13165-1","title":"ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:20:35.126789Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14174-1","title":"ruby3.3-rubygem-nokogiri-1.15.5-1.5 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T03:03:19.688417Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:14697-1","title":"ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-25T00:00:00Z","modified":"2026-02-04T03:50:12.082525Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2026:10356-1","title":"ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:44:10.568806Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2018:3080-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following security issues:\n\n- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause a\n  denial of service (infinite loop) via a crafted XML file that triggers\n  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279)\n- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted XML\n  file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n  (bsc#1105166)\n- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()\n  function when parsing an invalid XPath expression in the XPATH_OP_AND or\n  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046)\n","status":"published","published":"2018-10-09T09:08:39Z","modified":"2026-02-04T02:39:44.947551Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3081-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following security issues:\n\n- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause a\n  denial of service (infinite loop) via a crafted XML file that triggers\n  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279).\n- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted XML\n  file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n  (bsc#1105166).\n- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()\n  function when parsing an invalid XPath expression in the XPATH_OP_AND or\n  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046).\n- CVE-2017-18258: The xz_head function allowed remote attackers to cause a\n  denial of service (memory consumption) via a crafted LZMA file, because the\n  decoder functionality did not restrict memory usage to what is required for a\n  legitimate file (bsc#1088601).\n","status":"published","published":"2018-10-09T09:08:27Z","modified":"2026-02-04T04:30:17.005947Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2019:0272-1","title":"Security update for rmt-server","description":"This update for rmt-server to version 1.1.1 fixes the following issues:\n\nThe following issues have been fixed:\n\n- Fixed migration problems which caused some extensions / modules to be dropped (bsc#1118584, bsc#1118579)\n- Fixed listing of mirrored products (bsc#1102193)\n- Include online migration paths into offline migration (bsc#1117106)\n- Sync products that do not have a base product (bsc#1109307)\n- Fixed SLP auto discovery for RMT (bsc#1113760)\n\nUpdate dependencies for security fixes:\n\n- CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969)\n- CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831)\n- CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046)\n","status":"published","published":"2019-02-06T15:46:17Z","modified":"2026-02-04T03:00:10.48101Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13985-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()\n  function when parsing an invalid XPath expression in the XPATH_OP_AND or\n  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046)\n\nOther Issue fixed:\n\n- Fixed a bug related to the fix for CVE-2016-9318 which allowed xsltproc to access \n  the internet even when --nonet was given and also was making docbook-xsl-stylesheets to have \n  incomplete xml catalog file (bsc#1010675, bsc#1126613 and bsc#1110146).\n","status":"published","published":"2019-03-21T17:41:21Z","modified":"2025-05-02T04:05:39.570657Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-3739-1","title":"libxml2 vulnerabilities","description":"Matias Brutti discovered that libxml2 incorrectly handled certain XML files.\nAn attacker could possibly use this issue to expose sensitive information.\n(CVE-2016-9318)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2017-16932)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2017-18258, CVE-2018-14404, CVE-2018-14567)\n","status":"published","published":"2018-08-14T17:28:27Z","modified":"2026-04-22T09:48:27.757606Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}