IM
IronMonkey Threat Research

CVE-2019-20388 HIGH

Published: 2020-01-21 | Last Modified: 2025-12-17 | Status: Modified

Description

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

Additional Descriptions (1)

La función xmlSchemaPreRun en el archivo xmlschemas.c en libxml2 versión 2.9.10, permite una pérdida de memoria de la función xmlSchemaValidateStream.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-401
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-401

Affected Products

Vendor Product Version Update Type
xmlsoft libxml2 2.9.10 <built-in method update of dict object at 0x72a99a7f10c0> Application
debian debian_linux 9.0 <built-in method update of dict object at 0x72a99a7f0480> Operating System
netapp cloud_backup - <built-in method update of dict object at 0x72a9b091a740> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x72a99a7f1d00> Application
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x72a99a7f1d80> Application
netapp plug-in_for_symantec_netbackup - <built-in method update of dict object at 0x72a99a7f0d40> Application
netapp smi-s_provider - <built-in method update of dict object at 0x72a9b091bcc0> Application
netapp snapdrive - <built-in method update of dict object at 0x72a99a7f2e40> Application
netapp steelstore_cloud_integrated_storage - <built-in method update of dict object at 0x72a99a7f3b00> Application
netapp h300s_firmware - <built-in method update of dict object at 0x72a99a7f3200> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x72a9b091a800> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x72a99a7f22c0> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x72a9cc898f80> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x72a99a7f3140> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x72a99a7f3ec0> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x72a99a7f2a80> Operating System
oracle communications_cloud_native_core_network_function_cloud_native_environment 1.10.0 <built-in method update of dict object at 0x72a99a7f0200> Application
oracle enterprise_manager_base_platform 13.4.0.0 <built-in method update of dict object at 0x72a99a7f2900> Application
oracle enterprise_manager_base_platform 13.5.0.0 <built-in method update of dict object at 0x72a9cc724980> Application
oracle enterprise_manager_ops_center 12.4.0.0 <built-in method update of dict object at 0x72a9cc725800> Application
oracle mysql_workbench * <built-in method update of dict object at 0x72a9b0b4b440> Application
oracle peoplesoft_enterprise_peopletools 8.58 <built-in method update of dict object at 0x72a99a7f2540> Application
oracle real_user_experience_insight 13.3.1.0 <built-in method update of dict object at 0x72a9b091a040> Application
oracle real_user_experience_insight 13.4.1.0 <built-in method update of dict object at 0x72a99a7f0280> Application
oracle real_user_experience_insight 13.5.1.0 <built-in method update of dict object at 0x72a9b0b4a0c0> Application
opensuse leap 15.1 <built-in method update of dict object at 0x72a99a7f3f00> Operating System
fedoraproject fedora 30 <built-in method update of dict object at 0x72a99a7f1040> Operating System
fedoraproject fedora 31 <built-in method update of dict object at 0x72a99a7f0f40> Operating System
fedoraproject fedora 32 <built-in method update of dict object at 0x72a9cd0bcf40> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:xmlsoft:libxml2:2.9.10:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:*
Yes cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:real_user_experience_insight:13.3.1.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

References

Notification
Message here