IM
IronMonkey Threat Research

CVE-2020-7595 HIGH

Published: 2020-01-21 | Last Modified: 2025-12-03 | Status: Modified

Description

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Additional Descriptions (1)

La función xmlStringLenDecodeEntities en el archivo parser.c en libxml2 versión 2.9.10, presenta un bucle infinito en una determinada situación de fin del archivo.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-835
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-835

Affected Products

Vendor Product Version Update Type
xmlsoft libxml2 2.9.10 <built-in method update of dict object at 0x7fd39c4de740> Application
fedoraproject fedora 30 <built-in method update of dict object at 0x7fd340a42800> Operating System
fedoraproject fedora 31 <built-in method update of dict object at 0x7fd341256540> Operating System
fedoraproject fedora 32 <built-in method update of dict object at 0x7fd2d24ecfc0> Operating System
canonical ubuntu_linux 12.04 <built-in method update of dict object at 0x7fd39c4de200> Operating System
canonical ubuntu_linux 14.04 <built-in method update of dict object at 0x7fd39c4df180> Operating System
canonical ubuntu_linux 16.04 <built-in method update of dict object at 0x7fd386657ec0> Operating System
canonical ubuntu_linux 18.04 <built-in method update of dict object at 0x7fd384e2b480> Operating System
canonical ubuntu_linux 19.10 <built-in method update of dict object at 0x7fd319943000> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd39c4dd780> Operating System
siemens sinema_remote_connect_server * <built-in method update of dict object at 0x7fd369e80b80> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd360274f80> Application
netapp smi-s_provider - <built-in method update of dict object at 0x7fd340ad8d40> Application
netapp snapdrive - <built-in method update of dict object at 0x7fd36b3cbc00> Application
netapp steelstore_cloud_integrated_storage - <built-in method update of dict object at 0x7fd360274980> Application
netapp symantec_netbackup - <built-in method update of dict object at 0x7fd37033d740> Application
netapp h300s_firmware - <built-in method update of dict object at 0x7fd384659ac0> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd3412562c0> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd36a663780> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x7fd2d24edc40> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x7fd340a41e80> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x7fd360275a40> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd340a40140> Operating System
netapp h410c_firmware - <built-in method update of dict object at 0x7fd3602779c0> Operating System
oracle real_user_experience_insight 13.3.1.0 <built-in method update of dict object at 0x7fd384e284c0> Application
oracle communications_cloud_native_core_network_function_cloud_native_environment 1.10.0 <built-in method update of dict object at 0x7fd34bb7cc40> Application
oracle enterprise_manager_base_platform 13.4.0.0 <built-in method update of dict object at 0x7fd2dbc98a00> Application
oracle enterprise_manager_base_platform 13.5.0.0 <built-in method update of dict object at 0x7fd2d24ecbc0> Application
oracle enterprise_manager_ops_center 12.4.0.0 <built-in method update of dict object at 0x7fd37018ed00> Application
oracle mysql_workbench * <built-in method update of dict object at 0x7fd368e8a280> Application
oracle peoplesoft_enterprise_peopletools 8.58 <built-in method update of dict object at 0x7fd36a7ddbc0> Application
oracle real_user_experience_insight 13.4.1.0 <built-in method update of dict object at 0x7fd369e83d00> Application
oracle real_user_experience_insight 13.5.1.0 <built-in method update of dict object at 0x7fd36a7dde80> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:xmlsoft:libxml2:2.9.10:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:*
Yes cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:symantec_netbackup:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:real_user_experience_insight:13.3.1.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:*

References