CVE-2018-9251
Fixed in a distro release EPSS 2%
The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.
Products: xmlsoft libxml2, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | libxml2 | 2.9.8-r1 |
| Alpine 3.11 | libxml2 | 2.9.8-r1 |
| Alpine 3.12 | libxml2 | 2.9.8-r1 |
| Alpine 3.13 | libxml2 | 2.9.8-r1 |
| Alpine 3.14 | libxml2 | 2.9.8-r1 |
| Alpine 3.15 | libxml2 | 2.9.8-r1 |
| Alpine 3.16 | libxml2 | 2.9.8-r1 |
| Alpine 3.17 | libxml2 | 2.9.8-r1 |
| Alpine 3.18 | libxml2 | 2.9.8-r1 |
| Alpine 3.19 | libxml2 | 2.9.8-r1 |
| Alpine 3.20 | libxml2 | 2.9.8-r1 |
| Alpine 3.21 | libxml2 | 2.9.8-r1 |
| Alpine 3.22 | libxml2 | 2.9.8-r1 |
| Alpine 3.23 | libxml2 | 2.9.8-r1 |
| Alpine 3.24 | libxml2 | 2.9.8-r1 |
| Alpine 3.5 | libxml2 | 2.9.8-r1 |
| Alpine 3.6 | libxml2 | 2.9.8-r1 |
| Alpine 3.7 | libxml2 | 2.9.8-r1 |
| Alpine 3.8 | libxml2 | 2.9.8-r1 |
| Alpine 3.9 | libxml2 | 2.9.8-r1 |
| Arch Linux | lib32-libxml2 | 2.9.8-4 |
| Arch Linux | libxml2 | 2.9.8-5 |
| Red Hat Enterprise Linux 8 | libxml2 | 0:2.9.7-7.el8 |
| Red Hat Enterprise Linux 8 | libxml2-debuginfo | 0:2.9.7-7.el8 |
| Red Hat Enterprise Linux 8 | libxml2-debugsource | 0:2.9.7-7.el8 |
| Red Hat Enterprise Linux 8 | libxml2-devel | 0:2.9.7-7.el8 |
| Red Hat Enterprise Linux 8 | python3-libxml2 | 0:2.9.7-7.el8 |
| Red Hat Enterprise Linux 8 | python3-libxml2-debuginfo | 0:2.9.7-7.el8 |
| SUSE Linux Enterprise Desktop 12 SP3 | libxml2 | 2.9.4-46.15.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | python-libxml2 | 2.9.4-46.15.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | libxml2 | 2.9.7-3.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | python-libxml2-python | 2.9.7-3.3.1 |
| SUSE Linux Enterprise Server 12 SP3 | libxml2 | 2.9.4-46.15.1 |
| SUSE Linux Enterprise Server 12 SP3 | python-libxml2 | 2.9.4-46.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | libxml2 | 2.9.4-46.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | python-libxml2 | 2.9.4-46.15.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libxml2 | 2.9.4-46.15.1 |
| openSUSE Tumbleweed | libxml2 | 2.9.12-1.2 |