PT-2019-5585 · Libxml2+6 · Libxml2+6

Published 2019-08-20 · Updated 2026-03-13 · CVE-2019-20388

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.10

Description The issue is related to a memory leak in the xmlschemas.c component of the libxml2 library. This occurs due to a resource not being released after its valid lifetime has expired. Exploitation of this issue could allow a remote attacker to cause a denial of service.

Recommendations For libxml2 version 2.9.10, consider applying a patch or updating to a newer version that fixes the memory leak in the xmlSchemaPreRun function in xmlschemas.c to prevent potential denial of service attacks.

Fix

Memory Leak

Improper Resource Release

Weakness Enumeration

CWE-401

CWE-404

Related Identifiers

ALT-PU-2020-3218

ALT-PU-2020-3244

ALT-PU-2021-1579

ALT-PU-2021-2057

ALT-PU-2021-2997

ALT-PU-2021-3332

ALT-PU-2023-4266

ALT-PU-2024-7812

BDU:2020-04514

CESA-2020_3996

CESA-2020_4479

CVE-2019-20388

DLA-2369-1

MGASA-2020-0101

OPENSUSE-SU-2020:0681-1

OPENSUSE-SU-2020_0681-1

OPENSUSE-SU-2024:11016-1

OPENSUSE-SU-2024:11340-1

OPENSUSE-SU-2024:11912-1

OPENSUSE-SU-2024:13165-1

OPENSUSE-SU-2024:14174-1

OPENSUSE-SU-2025:14697-1

OPENSUSE-SU-2026:10356-1

RHSA-2020:2644

RHSA-2020:3996

RHSA-2020:4479

RHSA-2020_3996

RHSA-2020_4479

SUSE-SU-2020:1299-1

SUSE-SU-2020:2609-1

SUSE-SU-2021:14729-1

SUSE-SU-2021_14729-1

USN-4991-1

Affected Products

Alt Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Libxml2

References · 124

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14174-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0681-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/681760 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8872 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-20388 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2020.html · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20388 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://linux.oracle.com/errata/ELSA-2020-3996.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:14729-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11016-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4479.html · Vendor Advisory