CVE-2019-20388

high-risk

Published 2020-01-21

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

Do I need to act?

0.61% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

Libxml2

Debian Linux

Cloud Backup

Clustered Data Ontap

Ontap Select Deploy Administration Utility

Plug-In For Symantec Netbackup

Smi-S Provider

Snapdrive

Steelstore Cloud Integrated Storage

H300S Firmware

H500S Firmware

H700S Firmware

H300E Firmware

H500E Firmware

H700E Firmware

H410S Firmware

Communications Cloud Native Core Network Function Cloud Native Environment

Enterprise Manager Base Platform

Enterprise Manager Ops Center

Affected Vendors

Debian Oracle Xmlsoft Fedoraproject Netapp Opensuse

References (24)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html

Patch https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68

Mailing List https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202010-04

Third Party Advisory https://security.netapp.com/advisory/ntap-20200702-0005/

Patch https://www.oracle.com/security-alerts/cpuapr2022.html

Patch https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/security-alerts/cpujul2022.html

Patch https://www.oracle.com/security-alerts/cpuoct2021.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html

Patch https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68

Mailing List https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202010-04

Third Party Advisory https://security.netapp.com/advisory/ntap-20200702-0005/

and 4 more references

/ 100

high-risk

Severity 26/34 · High

Exploitability 2/34 · Minimal

Exposure 22/34 · High