CVE-2020-24977

Published: 04 September 2020

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

Priority

Low

CVSS 3 base score: 6.5

Status

Package Release Status
libxml2
Launchpad, Ubuntu, Debian
Upstream
Released (2.9.10+dfsg-6.2)
Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(2.9.10+dfsg-6.3build2)
Ubuntu 20.10 (Groovy Gorilla) Needed

Ubuntu 20.04 LTS (Focal Fossa) Needed

Ubuntu 18.04 LTS (Bionic Beaver) Needed

Ubuntu 16.04 LTS (Xenial Xerus) Needed

Ubuntu 14.04 ESM (Trusty Tahr) Needs triage

Patches:
Upstream: https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2