{"id":"CVE-2018-9251","aliases":["ALPINE-CVE-2018-9251","BELL-CVE-2018-9251","EUVD-2018-20845","GHSA-qvh5-3xv2-rf6p","MGASA-2019-0047","RHSA-2020:1827","SUSE-SU-2018:3080-1","SUSE-SU-2018:3081-1","openSUSE-SU-2024:11016-1"],"status":"published","title":"The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote...","description":"The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02357,"percentile":0.83871,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2018-04-04T02:00:00Z","modified":"2026-10-24T10:30:37Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libxml2","fixed_in":["2.9.8-r1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"perl-XML-LibXML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.200-1.1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-7.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"python-libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.12-1.2"}]}],"bundled":18}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=794914","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9251","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qvh5-3xv2-rf6p"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-9251","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-9251","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0047.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23410","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/G5AFZARX7BUSU24J2MJ4AHX5OE47UXQA/","tags":["web"]},{"url":"https://usn.ubuntu.com/3739-1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1827","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1565318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595985","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1827.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-9251","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-9251","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14404","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1088279","tags":["report"]},{"url":"https://bugzilla.suse.com/1102046","tags":["report"]},{"url":"https://bugzilla.suse.com/1105166","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9251","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183081-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1088601","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18258","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3541","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-9251","description":"The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.","status":"published","published":"2018-04-04T02:00:00Z","modified":"2024-08-05T07:17:51.941Z","updated_at":"2026-11-02T14:35:02.603326Z"}],"euvd":[{"id":"EUVD-2018-20845","description":"The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.","status":"published","published":"2018-04-04T02:00:00Z","modified":"2024-08-05T07:17:51Z","updated_at":"2026-11-03T02:40:00.465176Z"}],"ghsa":[{"id":"GHSA-qvh5-3xv2-rf6p","title":"The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote...","description":"The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.","status":"published","published":"2022-05-13T01:53:53Z","modified":"2023-02-02T05:02:21Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:51:25.546182Z"}],"nvd":[{"id":"CVE-2018-9251","description":"The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.","status":"published","published":"2018-04-04T02:29:00.32Z","modified":"2026-06-17T02:06:17.68Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"ALPINE-CVE-2018-9251","description":"The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.","status":"published","published":"2018-04-04T02:29:00.32Z","modified":"2026-10-23T17:17:55.308254404Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2018-9251","title":"CVE-2018-9251 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:37.75707Z","modified":"2026-01-26T09:47:45.859521Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-9251","description":"The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.","status":"published","published":"2018-04-04T02:29:00.32Z","modified":"2026-10-24T10:30:37.496386327Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"RHSA-2020:1827","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2024-09-16T03:15:14Z","modified":"2026-09-21T10:02:35Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"MGASA-2019-0047","title":"Updated libxml2 packages fix security vulnerabilities","description":"A flaw was found in libxml2 2.9.8. The xz_decomp function in xzlib.c, if\n--with-lzma is used, allows remote attackers to cause a denial of service\n(infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR,\nas demonstrated by xmllint (CVE-2018-9251, CVE-2018-14567).\n\nA null pointer dereference vulnerability exists in the\nxpath.c:xmlXPathCompOpEval() function of libxml2 when parsing invalid\nXPath expression. Applications processing untrusted XSL format inputs\nwith the use of libxml2 library may be vulnerable to denial of service\nattack due to crash of the application (CVE-2018-14404).\n\nThe libxml2 package has been updated to version 2.9.9 to fix these\nissues and other bugs.\n\nThe perl-XML-LibXML package has been rebuilt against the updated libxml2.\n","status":"published","published":"2019-01-23T15:50:09Z","modified":"2026-04-16T06:23:30.519837644Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11016-1","title":"libxml2-2-2.9.12-1.2 on GA media","description":"These are all security issues fixed in the libxml2-2-2.9.12-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:05.061414Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:3080-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following security issues:\n\n- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause a\n  denial of service (infinite loop) via a crafted XML file that triggers\n  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279)\n- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted XML\n  file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n  (bsc#1105166)\n- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()\n  function when parsing an invalid XPath expression in the XPATH_OP_AND or\n  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046)\n","status":"published","published":"2018-10-09T09:08:39Z","modified":"2026-02-04T02:39:44.947551Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3081-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following security issues:\n\n- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause a\n  denial of service (infinite loop) via a crafted XML file that triggers\n  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279).\n- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted XML\n  file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n  (bsc#1105166).\n- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()\n  function when parsing an invalid XPath expression in the XPATH_OP_AND or\n  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046).\n- CVE-2017-18258: The xz_head function allowed remote attackers to cause a\n  denial of service (memory consumption) via a crafted LZMA file, because the\n  decoder functionality did not restrict memory usage to what is required for a\n  legitimate file (bsc#1088601).\n","status":"published","published":"2018-10-09T09:08:27Z","modified":"2026-02-04T04:30:17.005947Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}