CVE-2020-7595 - 漏洞详情

CVE-2020-7595 (CNNVD-202001-965)

HIGH

中文标题:

libxml2 安全漏洞

英文标题:

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-fi...

CVSS分数: 7.5

发布时间: 2020-01-21 22:54:14

漏洞类型: 其他

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

libxml2是开源的一个用来解析XML文档的函数库。它用C语言写成，并且能为多种语言所调用，例如C语言，C++，XSH。 libxml2 2.9.10版本中的parser.c文件的xmlStringLenDecodeEntities存在安全漏洞。攻击者可利用该漏洞造成无限循环。

英文描述:

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

CWE类型:

CWE-835

受影响产品

厂商	产品	版本	版本范围	平台	CPE
xmlsoft	libxml2	2.9.10	-	-	`cpe:2.3:a:xmlsoft:libxml2:2.9.10:::::::*`
fedoraproject	fedora	30	-	-	`cpe:2.3:o:fedoraproject:fedora:30:::::::*`
fedoraproject	fedora	31	-	-	`cpe:2.3:o:fedoraproject:fedora:31:::::::*`
fedoraproject	fedora	32	-	-	`cpe:2.3:o:fedoraproject:fedora:32:::::::*`
canonical	ubuntu_linux	12.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::`
canonical	ubuntu_linux	14.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::`
canonical	ubuntu_linux	16.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::`
canonical	ubuntu_linux	18.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::`
canonical	ubuntu_linux	19.10	-	-	`cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
siemens	sinema_remote_connect_server	*	-	-	`cpe:2.3:a:siemens:sinema_remote_connect_server::::::::`
netapp	clustered_data_ontap	-	-	-	`cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*`
netapp	smi-s_provider	-	-	-	`cpe:2.3:a:netapp:smi-s_provider:-:::::::*`
netapp	snapdrive	-	-	-	`cpe:2.3:a:netapp:snapdrive:-:::::windows::`
netapp	steelstore_cloud_integrated_storage	-	-	-	`cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*`
netapp	symantec_netbackup	-	-	-	`cpe:2.3:a:netapp:symantec_netbackup:-:::::::*`
netapp	h300s_firmware	-	-	-	`cpe:2.3:o:netapp:h300s_firmware:-:::::::*`
netapp	h500s_firmware	-	-	-	`cpe:2.3:o:netapp:h500s_firmware:-:::::::*`
netapp	h700s_firmware	-	-	-	`cpe:2.3:o:netapp:h700s_firmware:-:::::::*`
netapp	h300e_firmware	-	-	-	`cpe:2.3:o:netapp:h300e_firmware:-:::::::*`
netapp	h500e_firmware	-	-	-	`cpe:2.3:o:netapp:h500e_firmware:-:::::::*`
netapp	h700e_firmware	-	-	-	`cpe:2.3:o:netapp:h700e_firmware:-:::::::*`
netapp	h410s_firmware	-	-	-	`cpe:2.3:o:netapp:h410s_firmware:-:::::::*`
netapp	h410c_firmware	-	-	-	`cpe:2.3:o:netapp:h410c_firmware:-:::::::*`
oracle	real_user_experience_insight	13.3.1.0	-	-	`cpe:2.3:a:oracle:real_user_experience_insight:13.3.1.0:::::::*`
oracle	communications_cloud_native_core_network_function_cloud_native_environment	1.10.0	-	-	`cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:::::::*`
oracle	enterprise_manager_base_platform	13.4.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:::::::*`
oracle	enterprise_manager_base_platform	13.5.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:::::::*`
oracle	enterprise_manager_ops_center	12.4.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:::::::*`
oracle	mysql_workbench	*	-	-	`cpe:2.3:a:oracle:mysql_workbench::::::::`
oracle	peoplesoft_enterprise_peopletools	8.58	-	-	`cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:::::::*`
oracle	real_user_experience_insight	13.4.1.0	-	-	`cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:::::::*`
oracle	real_user_experience_insight	13.5.1.0	-	-	`cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

FEDORA-2020-41fe1680f6 vendor-advisory
cve.org

访问

USN-4274-1 vendor-advisory
cve.org

访问

FEDORA-2020-0c71c00af4 vendor-advisory
cve.org

访问

FEDORA-2020-7694e8be73 vendor-advisory
cve.org

访问

openSUSE-SU-2020:0681 vendor-advisory
cve.org

访问