IM
IronMonkey Threat Research

CVE-2019-20388 HIGH

Published: 2020-01-21 | Last Modified: 2025-12-17 | Status: Modified

Description

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

Additional Descriptions (1)

La función xmlSchemaPreRun en el archivo xmlschemas.c en libxml2 versión 2.9.10, permite una pérdida de memoria de la función xmlSchemaValidateStream.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-401
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-401

Affected Products

Vendor Product Version Update Type
xmlsoft libxml2 2.9.10 <built-in method update of dict object at 0x7fd39c4e8900> Application
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd36b4491c0> Operating System
netapp cloud_backup - <built-in method update of dict object at 0x7fd36a7ed700> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd34927ca80> Application
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd39c4e92c0> Application
netapp plug-in_for_symantec_netbackup - <built-in method update of dict object at 0x7fd39c4e9480> Application
netapp smi-s_provider - <built-in method update of dict object at 0x7fd369450b40> Application
netapp snapdrive - <built-in method update of dict object at 0x7fd39c4eb780> Application
netapp steelstore_cloud_integrated_storage - <built-in method update of dict object at 0x7fd39c4ea340> Application
netapp h300s_firmware - <built-in method update of dict object at 0x7fd39c4eb540> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd39c4e8e40> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd36b448040> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x7fd319c76300> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x7fd385665a40> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x7fd370345c80> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd37018d880> Operating System
oracle communications_cloud_native_core_network_function_cloud_native_environment 1.10.0 <built-in method update of dict object at 0x7fd2a15ba140> Application
oracle enterprise_manager_base_platform 13.4.0.0 <built-in method update of dict object at 0x7fd39c4e85c0> Application
oracle enterprise_manager_base_platform 13.5.0.0 <built-in method update of dict object at 0x7fd39c4e8700> Application
oracle enterprise_manager_ops_center 12.4.0.0 <built-in method update of dict object at 0x7fd2dbd9e280> Application
oracle mysql_workbench * <built-in method update of dict object at 0x7fd3855bed40> Application
oracle peoplesoft_enterprise_peopletools 8.58 <built-in method update of dict object at 0x7fd39c4e8980> Application
oracle real_user_experience_insight 13.3.1.0 <built-in method update of dict object at 0x7fd2dbd53dc0> Application
oracle real_user_experience_insight 13.4.1.0 <built-in method update of dict object at 0x7fd39c4e83c0> Application
oracle real_user_experience_insight 13.5.1.0 <built-in method update of dict object at 0x7fd38677d980> Application
opensuse leap 15.1 <built-in method update of dict object at 0x7fd38469f240> Operating System
fedoraproject fedora 30 <built-in method update of dict object at 0x7fd3703b98c0> Operating System
fedoraproject fedora 31 <built-in method update of dict object at 0x7fd36945fec0> Operating System
fedoraproject fedora 32 <built-in method update of dict object at 0x7fd36948c480> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:xmlsoft:libxml2:2.9.10:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:*
Yes cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:real_user_experience_insight:13.3.1.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

References