Action not permitted
Modal body text goes here.
ghsa-6qvp-r6r3-9p7h
Vulnerability from github
Published
2019-01-17 14:05
Modified
2023-08-26 00:01
Severity
Summary
Nokogiri NULL Pointer Dereference
Details
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-14404"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:20:04Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "A NULL pointer dereference vulnerability exists in the `xpath.c:xmlXPathCompOpEval()` function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the `XPATH_OP_AND` or `XPATH_OP_OR` case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.",
"id": "GHSA-6qvp-r6r3-9p7h",
"modified": "2023-08-26T00:01:34Z",
"published": "2019-01-17T14:05:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404"
},
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nokogiri/issues/1785"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1543"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-14404.yml"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190719-0002"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3739-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3739-2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Nokogiri NULL Pointer Dereference"
}
gsd-2018-14404
Vulnerability from gsd
Modified
2018-10-04 00:00
Details
Nokogiri 1.8.5 has been released.
This is a security and bugfix release. It addresses two CVEs in upstream
libxml2 rated as "medium" by Red Hat, for which details are below.
If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time,
though you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that these patches are not
yet (as of 2018-10-04) in an upstream release of libxml2.
Full details about the security update are available in Github Issue #1785.
[#1785]: https://github.com/sparklemotion/nokogiri/issues/1785
-----
[MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404
and CVE-2018-14567. Full details are available in #1785. Note that these
patches are not yet (as of 2018-10-04) in an upstream release of libxml2.
-----
CVE-2018-14404
Permalink:
https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html
Description:
A NULL pointer dereference vulnerability exists in the
xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when
parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR
case. Applications processing untrusted XSL format inputs with the use of
the libxml2 library may be vulnerable to a denial of service attack due
to a crash of the application
Canonical rates this vulnerability as "Priority: Medium"
-----
CVE-2018-14567
Permalink:
https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html
Description:
infinite loop in LZMA decompression
Canonical rates this vulnerability as "Priority: Medium"
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2018-14404",
"description": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.",
"id": "GSD-2018-14404",
"references": [
"https://www.suse.com/security/cve/CVE-2018-14404.html",
"https://access.redhat.com/errata/RHSA-2020:1827",
"https://access.redhat.com/errata/RHBA-2020:1540",
"https://access.redhat.com/errata/RHBA-2020:1539",
"https://access.redhat.com/errata/RHBA-2020:1310",
"https://access.redhat.com/errata/RHSA-2020:1190",
"https://access.redhat.com/errata/RHSA-2019:1543",
"https://ubuntu.com/security/CVE-2018-14404",
"https://advisories.mageia.org/CVE-2018-14404.html",
"https://alas.aws.amazon.com/cve/html/CVE-2018-14404.html",
"https://linux.oracle.com/cve/CVE-2018-14404.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri",
"purl": "pkg:gem/nokogiri"
}
}
],
"aliases": [
"CVE-2018-14404",
"GHSA-6qvp-r6r3-9p7h"
],
"details": "Nokogiri 1.8.5 has been released.\n\nThis is a security and bugfix release. It addresses two CVEs in upstream\nlibxml2 rated as \"medium\" by Red Hat, for which details are below.\n\nIf you\u0027re using your distro\u0027s system libraries, rather than Nokogiri\u0027s\nvendored libraries, there\u0027s no security need to upgrade at this time,\nthough you may want to check with your distro whether they\u0027ve patched this\n(Canonical has patched Ubuntu packages). Note that these patches are not\nyet (as of 2018-10-04) in an upstream release of libxml2.\n\nFull details about the security update are available in Github Issue #1785.\n[#1785]: https://github.com/sparklemotion/nokogiri/issues/1785\n\n-----\n\n[MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404\nand CVE-2018-14567. Full details are available in #1785. Note that these\npatches are not yet (as of 2018-10-04) in an upstream release of libxml2.\n\n-----\n\nCVE-2018-14404\n\nPermalink:\n\nhttps://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html\n\nDescription:\n\nA NULL pointer dereference vulnerability exists in the\nxpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when\nparsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR\ncase. Applications processing untrusted XSL format inputs with the use of\nthe libxml2 library may be vulnerable to a denial of service attack due\nto a crash of the application\n\nCanonical rates this vulnerability as \"Priority: Medium\"\n\n-----\n\nCVE-2018-14567\n\nPermalink:\n\nhttps://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html\n\nDescription:\n\ninfinite loop in LZMA decompression\n\nCanonical rates this vulnerability as \"Priority: Medium\"\n",
"id": "GSD-2018-14404",
"modified": "2018-10-04T00:00:00.000Z",
"published": "2018-10-04T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nokogiri/issues/1785"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74"
}
],
"related": [
"CVE-2018-14567"
],
"schema_version": "1.4.0",
"severity": [
{
"score": 7.5,
"type": "CVSS_V3"
}
],
"summary": "Nokogiri gem, via libxml2, is affected by multiple vulnerabilities"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-14404",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[debian-lts-announce] 20180927 [SECURITY] [DLA 1524-1] libxml2 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"
},
{
"name": "https://gitlab.gnome.org/GNOME/libxml2/issues/10",
"refsource": "MISC",
"url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10"
},
{
"name": "USN-3739-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3739-1/"
},
{
"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817",
"refsource": "MISC",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817"
},
{
"name": "USN-3739-2",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3739-2/"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985"
},
{
"name": "RHSA-2019:1543",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1543"
},
{
"name": "https://security.netapp.com/advisory/ntap-20190719-0002/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20190719-0002/"
},
{
"name": "[debian-lts-announce] 20200909 [SECURITY] [DLA 2369-1] libxml2 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2018-14404",
"cvss_v3": 7.5,
"date": "2018-10-04",
"description": "Nokogiri 1.8.5 has been released.\n\nThis is a security and bugfix release. It addresses two CVEs in upstream\nlibxml2 rated as \"medium\" by Red Hat, for which details are below.\n\nIf you\u0027re using your distro\u0027s system libraries, rather than Nokogiri\u0027s\nvendored libraries, there\u0027s no security need to upgrade at this time,\nthough you may want to check with your distro whether they\u0027ve patched this\n(Canonical has patched Ubuntu packages). Note that these patches are not\nyet (as of 2018-10-04) in an upstream release of libxml2.\n\nFull details about the security update are available in Github Issue #1785.\n[#1785]: https://github.com/sparklemotion/nokogiri/issues/1785\n\n-----\n\n[MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404\nand CVE-2018-14567. Full details are available in #1785. Note that these\npatches are not yet (as of 2018-10-04) in an upstream release of libxml2.\n\n-----\n\nCVE-2018-14404\n\nPermalink:\n\nhttps://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html\n\nDescription:\n\nA NULL pointer dereference vulnerability exists in the\nxpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when\nparsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR\ncase. Applications processing untrusted XSL format inputs with the use of\nthe libxml2 library may be vulnerable to a denial of service attack due\nto a crash of the application\n\nCanonical rates this vulnerability as \"Priority: Medium\"\n\n-----\n\nCVE-2018-14567\n\nPermalink:\n\nhttps://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html\n\nDescription:\n\ninfinite loop in LZMA decompression\n\nCanonical rates this vulnerability as \"Priority: Medium\"\n",
"gem": "nokogiri",
"ghsa": "6qvp-r6r3-9p7h",
"patched_versions": [
"\u003e= 1.8.5"
],
"related": {
"cve": [
"2018-14567"
],
"url": [
"https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ",
"https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594",
"https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74"
]
},
"title": "Nokogiri gem, via libxml2, is affected by multiple vulnerabilities",
"url": "https://github.com/sparklemotion/nokogiri/issues/1785"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c1.8.5",
"affected_versions": "All versions before 1.8.5",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-476",
"CWE-937"
],
"date": "2020-09-10",
"description": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.",
"fixed_versions": [
"1.8.5"
],
"identifier": "CVE-2018-14404",
"identifiers": [
"CVE-2018-14404"
],
"not_impacted": "All versions starting from 1.8.5",
"package_slug": "gem/nokogiri",
"pubdate": "2018-07-19",
"solution": "Upgrade to version 1.8.5 or above.",
"title": "NULL Pointer Dereference",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2018-14404",
"https://gitlab.gnome.org/GNOME/libxml2/issues/10",
"https://bugzilla.redhat.com/show_bug.cgi?id=1595985",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817",
"https://usn.ubuntu.com/3739-2/",
"https://usn.ubuntu.com/3739-1/",
"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html",
"https://access.redhat.com/errata/RHSA-2019:1543",
"https://security.netapp.com/advisory/ntap-20190719-0002/",
"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"
],
"uuid": "a96ed9d3-2bdf-4faa-895d-17d44e07b009"
},
{
"affected_range": "(,2.9.8]",
"affected_versions": "All versions up to 2.9.8",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-476",
"CWE-937"
],
"date": "2020-09-10",
"description": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.",
"fixed_versions": [],
"identifier": "CVE-2018-14404",
"identifiers": [
"CVE-2018-14404"
],
"not_impacted": "",
"package_slug": "nuget/libxml2",
"pubdate": "2018-07-19",
"solution": "Unfortunately, there is no solution available yet.",
"title": "NULL Pointer Dereference",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2018-14404"
],
"uuid": "1d51165b-9cd3-4496-92bd-a64df80e60ea"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.9.8",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-14404"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gitlab.gnome.org/GNOME/libxml2/issues/10",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985"
},
{
"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817",
"refsource": "MISC",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817"
},
{
"name": "USN-3739-2",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/3739-2/"
},
{
"name": "USN-3739-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/3739-1/"
},
{
"name": "[debian-lts-announce] 20180927 [SECURITY] [DLA 1524-1] libxml2 security update",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"
},
{
"name": "RHSA-2019:1543",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2019:1543"
},
{
"name": "https://security.netapp.com/advisory/ntap-20190719-0002/",
"refsource": "CONFIRM",
"tags": [],
"url": "https://security.netapp.com/advisory/ntap-20190719-0002/"
},
{
"name": "[debian-lts-announce] 20200909 [SECURITY] [DLA 2369-1] libxml2 security update",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": true,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2020-09-10T01:15Z",
"publishedDate": "2018-07-19T13:29Z"
}
}
}
cve-2018-14404
Vulnerability from cvelistv5
Published
2018-07-19 13:00
Modified
2024-08-05 09:29
Severity
Summary
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
References
| URL | Tags |
|---|---|
| https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html | mailing-list, x_refsource_MLIST |
| https://gitlab.gnome.org/GNOME/libxml2/issues/10 | x_refsource_MISC |
| https://usn.ubuntu.com/3739-1/ | vendor-advisory, x_refsource_UBUNTU |
| https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817 | x_refsource_MISC |
| https://usn.ubuntu.com/3739-2/ | vendor-advisory, x_refsource_UBUNTU |
| https://bugzilla.redhat.com/show_bug.cgi?id=1595985 | x_refsource_MISC |
| https://access.redhat.com/errata/RHSA-2019:1543 | vendor-advisory, x_refsource_REDHAT |
| https://security.netapp.com/advisory/ntap-20190719-0002/ | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T09:29:51.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[debian-lts-announce] 20180927 [SECURITY] [DLA 1524-1] libxml2 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10"
},
{
"name": "USN-3739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3739-1/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817"
},
{
"name": "USN-3739-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3739-2/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985"
},
{
"name": "RHSA-2019:1543",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1543"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20190719-0002/"
},
{
"name": "[debian-lts-announce] 20200909 [SECURITY] [DLA 2369-1] libxml2 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-07-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-10T00:06:23",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[debian-lts-announce] 20180927 [SECURITY] [DLA 1524-1] libxml2 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10"
},
{
"name": "USN-3739-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3739-1/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817"
},
{
"name": "USN-3739-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3739-2/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985"
},
{
"name": "RHSA-2019:1543",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1543"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20190719-0002/"
},
{
"name": "[debian-lts-announce] 20200909 [SECURITY] [DLA 2369-1] libxml2 security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-14404",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[debian-lts-announce] 20180927 [SECURITY] [DLA 1524-1] libxml2 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"
},
{
"name": "https://gitlab.gnome.org/GNOME/libxml2/issues/10",
"refsource": "MISC",
"url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10"
},
{
"name": "USN-3739-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3739-1/"
},
{
"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817",
"refsource": "MISC",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817"
},
{
"name": "USN-3739-2",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3739-2/"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985"
},
{
"name": "RHSA-2019:1543",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1543"
},
{
"name": "https://security.netapp.com/advisory/ntap-20190719-0002/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20190719-0002/"
},
{
"name": "[debian-lts-announce] 20200909 [SECURITY] [DLA 2369-1] libxml2 security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-14404",
"datePublished": "2018-07-19T13:00:00",
"dateReserved": "2018-07-19T00:00:00",
"dateUpdated": "2024-08-05T09:29:51.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading...