{"id":"CVE-2018-14567","aliases":["ALPINE-CVE-2018-14567","BELL-CVE-2018-14567","DEBIAN-CVE-2018-14567","DLA-1524-1","DLA-2369-1","EUVD-2018-6476","GHSA-4h39-8h6h-93x3","MGASA-2019-0047","RHSA-2020:1190","SUSE-SU-2018:3080-1","SUSE-SU-2018:3081-1","UBUNTU-CVE-2018-14567","USN-3739-1"],"status":"published","title":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service ...","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04294,"percentile":0.91185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2018-07-31T00:00:00Z","modified":"2026-10-24T14:20:54Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.9.10+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","fixed_in":["2.9.1+dfsg1-3ubuntu4.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-5+deb8u7"}]}],"versions":["2.9.1+dfsg1-5","2.9.1+dfsg1-5+deb8u1","2.9.1+dfsg1-5+deb8u2","2.9.1+dfsg1-5+deb8u3","2.9.1+dfsg1-5+deb8u4","2.9.1+dfsg1-5+deb8u5","2.9.1+dfsg1-5+deb8u6"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-2.2+deb9u3"}]}],"versions":["2.9.4+dfsg1-2.2","2.9.4+dfsg1-2.2+deb9u1","2.9.4+dfsg1-2.2+deb9u2"],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"perl-XML-LibXML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.200-1.1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-6.el7.4"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.6"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.2"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.6"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.2"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1"],"bundled":5}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"http://www.securityfocus.com/bid/105198","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3739-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14567","tags":["advisory"]},{"url":"https://usn.ubuntu.com/3739-1"},{"url":"https://github.com/advisories/GHSA-4h39-8h6h-93x3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-14567","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-14567","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-14567","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0047.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23410","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/G5AFZARX7BUSU24J2MJ4AHX5OE47UXQA/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1190","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1277146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1358641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1523128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1619875","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1190.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8035","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5131","tags":["advisory"]},{"url":"https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15412","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15412","tags":["advisory"]},{"url":"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18258","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14404","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14567","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14567","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1088279","tags":["report"]},{"url":"https://bugzilla.suse.com/1102046","tags":["report"]},{"url":"https://bugzilla.suse.com/1105166","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9251","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183081-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1088601","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18258","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-14567","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3739-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14404","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-14567","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.","status":"published","published":"2018-08-16T20:00:00Z","modified":"2026-10-14T06:30:37.625Z","updated_at":"2026-11-02T14:35:00.589142Z"}],"euvd":[{"id":"EUVD-2018-6476","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.","status":"published","published":"2018-08-16T20:00:00Z","modified":"2026-10-14T06:30:37Z","updated_at":"2026-11-02T17:27:17.902641Z"}],"ghsa":[{"id":"GHSA-4h39-8h6h-93x3","title":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service ...","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.","status":"published","published":"2022-05-13T01:16:21Z","modified":"2026-10-14T09:32:19Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2018-14567","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.","status":"published","published":"2018-08-16T20:29:02.47Z","modified":"2026-10-14T07:16:43.043Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:04:36.842579Z"}],"osv":[{"id":"ALPINE-CVE-2018-14567","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.","status":"published","published":"2018-08-16T20:29:02.47Z","modified":"2026-10-23T17:17:55.215659293Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-14567","title":"CVE-2018-14567 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:27.849443Z","modified":"2026-01-26T09:48:32.415991Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-14567","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.","status":"published","published":"2018-08-16T20:29:02.47Z","modified":"2026-10-24T14:20:54.539338135Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-14567","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.","status":"published","published":"2018-08-16T20:29:02.47Z","modified":"2026-10-15T07:47:34.294134789Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"RHSA-2020:1190","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2024-09-16T03:18:57Z","modified":"2026-10-14T10:01:18Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2018-14567","description":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.","status":"published","published":"2018-07-31T00:00:00Z","modified":"2026-04-22T11:45:52.307667Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-1524-1","title":"libxml2 - security update","status":"published","published":"2018-09-27T00:00:00Z","modified":"2026-03-09T01:21:54.21619Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2369-1","title":"libxml2 - security update","status":"published","published":"2020-09-09T00:00:00Z","modified":"2026-03-09T01:23:38.236188Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2019-0047","title":"Updated libxml2 packages fix security vulnerabilities","description":"A flaw was found in libxml2 2.9.8. The xz_decomp function in xzlib.c, if\n--with-lzma is used, allows remote attackers to cause a denial of service\n(infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR,\nas demonstrated by xmllint (CVE-2018-9251, CVE-2018-14567).\n\nA null pointer dereference vulnerability exists in the\nxpath.c:xmlXPathCompOpEval() function of libxml2 when parsing invalid\nXPath expression. Applications processing untrusted XSL format inputs\nwith the use of libxml2 library may be vulnerable to denial of service\nattack due to crash of the application (CVE-2018-14404).\n\nThe libxml2 package has been updated to version 2.9.9 to fix these\nissues and other bugs.\n\nThe perl-XML-LibXML package has been rebuilt against the updated libxml2.\n","status":"published","published":"2019-01-23T15:50:09Z","modified":"2026-04-16T06:23:30.519837644Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"SUSE-SU-2018:3080-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following security issues:\n\n- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause a\n  denial of service (infinite loop) via a crafted XML file that triggers\n  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279)\n- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted XML\n  file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n  (bsc#1105166)\n- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()\n  function when parsing an invalid XPath expression in the XPATH_OP_AND or\n  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046)\n","status":"published","published":"2018-10-09T09:08:39Z","modified":"2026-02-04T02:39:44.947551Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3081-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following security issues:\n\n- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause a\n  denial of service (infinite loop) via a crafted XML file that triggers\n  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279).\n- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted XML\n  file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n  (bsc#1105166).\n- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()\n  function when parsing an invalid XPath expression in the XPATH_OP_AND or\n  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046).\n- CVE-2017-18258: The xz_head function allowed remote attackers to cause a\n  denial of service (memory consumption) via a crafted LZMA file, because the\n  decoder functionality did not restrict memory usage to what is required for a\n  legitimate file (bsc#1088601).\n","status":"published","published":"2018-10-09T09:08:27Z","modified":"2026-02-04T04:30:17.005947Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3739-1","title":"libxml2 vulnerabilities","description":"Matias Brutti discovered that libxml2 incorrectly handled certain XML files.\nAn attacker could possibly use this issue to expose sensitive information.\n(CVE-2016-9318)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2017-16932)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2017-18258, CVE-2018-14404, CVE-2018-14567)\n","status":"published","published":"2018-08-14T17:28:27Z","modified":"2026-04-22T09:48:27.757606Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}