Issued:
2020-11-03
Updated:
2020-11-03

RHSA-2020:4479 - Security Advisory

Synopsis

Moderate: libxml2 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libxml2 is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

  • libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c (CVE-2019-19956)
  • libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c (CVE-2019-20388)
  • libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations (CVE-2020-7595)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The desktop must be restarted (log out, then log back in) for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1788856 - CVE-2019-19956 libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c
  • BZ - 1799734 - CVE-2019-20388 libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c
  • BZ - 1799786 - CVE-2020-7595 libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations

Red Hat Enterprise Linux for x86_64 8

SRPM
libxml2-2.9.7-8.el8.src.rpm SHA-256: 77aec6364f73aefe740fce14bd564b11e86cfda042c18ab185b537cd08419f86
x86_64
libxml2-2.9.7-8.el8.i686.rpm SHA-256: 70a5f88864508dbdbe59ff4cb522b54262c45e681ab375e37a033b57cf9cc477
libxml2-2.9.7-8.el8.x86_64.rpm SHA-256: b15c1bdad5fe9228ab12c44a24962417c9a15620a16077421151912fca9ec350
libxml2-debuginfo-2.9.7-8.el8.i686.rpm SHA-256: aab28398b2c1020f76115dec1dbb071c2fdbcb3bc528949e9ed2a47e3b8bc4d8
libxml2-debuginfo-2.9.7-8.el8.i686.rpm SHA-256: aab28398b2c1020f76115dec1dbb071c2fdbcb3bc528949e9ed2a47e3b8bc4d8
libxml2-debuginfo-2.9.7-8.el8.x86_64.rpm SHA-256: 616debed27aba90df1feeb7d828d596627f6febda0540cba4e6a8b1abf68208c
libxml2-debuginfo-2.9.7-8.el8.x86_64.rpm SHA-256: 616debed27aba90df1feeb7d828d596627f6febda0540cba4e6a8b1abf68208c
libxml2-debugsource-2.9.7-8.el8.i686.rpm SHA-256: ab521970da6bda4e6b0b25462a6f02c05ec2a67289860c780db1bb60af83ba8e
libxml2-debugsource-2.9.7-8.el8.i686.rpm SHA-256: ab521970da6bda4e6b0b25462a6f02c05ec2a67289860c780db1bb60af83ba8e
libxml2-debugsource-2.9.7-8.el8.x86_64.rpm SHA-256: 06369484397edf0955bf271cbba6e6ccb33e134b8965be0a2277893309b71d21
libxml2-debugsource-2.9.7-8.el8.x86_64.rpm SHA-256: 06369484397edf0955bf271cbba6e6ccb33e134b8965be0a2277893309b71d21
libxml2-devel-2.9.7-8.el8.i686.rpm SHA-256: 31f3db33a6b0b32a8d22d89564953e2ee10afba1f96e2cd93d3faeef9f263c20
libxml2-devel-2.9.7-8.el8.x86_64.rpm SHA-256: 8a9e4a24826416cf71eef0c8dec226652e57add6ba4d50a7736ff84d4f015a76
python3-libxml2-2.9.7-8.el8.x86_64.rpm SHA-256: 4ccbefcbe75decfef38ccae5d8ff92ba6b00e8232b64ec46ae0c0be8ae20ec50
python3-libxml2-debuginfo-2.9.7-8.el8.i686.rpm SHA-256: 9d016568ca39a91841f84601837be849987a7e0e4bf223eb863befc8b660582b
python3-libxml2-debuginfo-2.9.7-8.el8.i686.rpm SHA-256: 9d016568ca39a91841f84601837be849987a7e0e4bf223eb863befc8b660582b
python3-libxml2-debuginfo-2.9.7-8.el8.x86_64.rpm SHA-256: 314060ad293dbd1fd05d20f65552f19c0baab377541f9aea94c6e423af2bc5a2
python3-libxml2-debuginfo-2.9.7-8.el8.x86_64.rpm SHA-256: 314060ad293dbd1fd05d20f65552f19c0baab377541f9aea94c6e423af2bc5a2

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
libxml2-2.9.7-8.el8.src.rpm SHA-256: 77aec6364f73aefe740fce14bd564b11e86cfda042c18ab185b537cd08419f86
s390x
libxml2-2.9.7-8.el8.s390x.rpm SHA-256: 063b2ae71b694cbf21b2f5355753b1990c78e99429a34823cf3dfb746cabe996
libxml2-debuginfo-2.9.7-8.el8.s390x.rpm SHA-256: 2e50283c8c5510019713cc23dd07fd77604a5f04c72e031f79a9671d5a6dd371
libxml2-debuginfo-2.9.7-8.el8.s390x.rpm SHA-256: 2e50283c8c5510019713cc23dd07fd77604a5f04c72e031f79a9671d5a6dd371
libxml2-debugsource-2.9.7-8.el8.s390x.rpm SHA-256: f899ac1fcc67a57d8e20580a2286869dfceaf06c98964962d08c1d1dd3ce37a9
libxml2-debugsource-2.9.7-8.el8.s390x.rpm SHA-256: f899ac1fcc67a57d8e20580a2286869dfceaf06c98964962d08c1d1dd3ce37a9
libxml2-devel-2.9.7-8.el8.s390x.rpm SHA-256: a11bff4b1f3865934ac395f700b59cd767d1532801edba77beb35d1fb671e265
python3-libxml2-2.9.7-8.el8.s390x.rpm SHA-256: cd121f15aa0c253c295fa0c70caf6f70ffab8c2c041c5f039b0469e851ea661b
python3-libxml2-debuginfo-2.9.7-8.el8.s390x.rpm SHA-256: c5ec17983f2b4438c2aec00f9eff12e6128e37f42651aa57006a6e970b250722
python3-libxml2-debuginfo-2.9.7-8.el8.s390x.rpm SHA-256: c5ec17983f2b4438c2aec00f9eff12e6128e37f42651aa57006a6e970b250722

Red Hat Enterprise Linux for Power, little endian 8

SRPM
libxml2-2.9.7-8.el8.src.rpm SHA-256: 77aec6364f73aefe740fce14bd564b11e86cfda042c18ab185b537cd08419f86
ppc64le
libxml2-2.9.7-8.el8.ppc64le.rpm SHA-256: 679ba7cf5974aaeb4b50a926e8fa28821f48b71c182d50b1033bccb6fdc34a06
libxml2-debuginfo-2.9.7-8.el8.ppc64le.rpm SHA-256: 9d87fd0afdc11d8ac09d6e245f9c9f3814bc8035ab3ec3c26dae683641d5c5b4
libxml2-debuginfo-2.9.7-8.el8.ppc64le.rpm SHA-256: 9d87fd0afdc11d8ac09d6e245f9c9f3814bc8035ab3ec3c26dae683641d5c5b4
libxml2-debugsource-2.9.7-8.el8.ppc64le.rpm SHA-256: 34720592359b64ec1b08229c9029be5df1ffe01b35ec7ebf6fc3071dacb81c8a
libxml2-debugsource-2.9.7-8.el8.ppc64le.rpm SHA-256: 34720592359b64ec1b08229c9029be5df1ffe01b35ec7ebf6fc3071dacb81c8a
libxml2-devel-2.9.7-8.el8.ppc64le.rpm SHA-256: c28df7e61ba05699928c50a1647f5f0dcbf559f4fe5481f6b2ea782b455d8637
python3-libxml2-2.9.7-8.el8.ppc64le.rpm SHA-256: ecd31959fe40425f51dae04269b063c5a77bd78a5445879b1c944f1aabb669bb
python3-libxml2-debuginfo-2.9.7-8.el8.ppc64le.rpm SHA-256: fc1b93cdc11600fc5722e399dc952bf3d3caa476d05d7592775fc6c19e8ef892
python3-libxml2-debuginfo-2.9.7-8.el8.ppc64le.rpm SHA-256: fc1b93cdc11600fc5722e399dc952bf3d3caa476d05d7592775fc6c19e8ef892

Red Hat Enterprise Linux for ARM 64 8

SRPM
libxml2-2.9.7-8.el8.src.rpm SHA-256: 77aec6364f73aefe740fce14bd564b11e86cfda042c18ab185b537cd08419f86
aarch64
libxml2-2.9.7-8.el8.aarch64.rpm SHA-256: fb56b7a416e12da0782ae8ba7396bc03a2f8844c2efcb5df3f8b9e74eb8b8059
libxml2-debuginfo-2.9.7-8.el8.aarch64.rpm SHA-256: 28abf952115cea63db7c297c91f1d4f1f523e718f78be1a798251546efb752aa
libxml2-debuginfo-2.9.7-8.el8.aarch64.rpm SHA-256: 28abf952115cea63db7c297c91f1d4f1f523e718f78be1a798251546efb752aa
libxml2-debugsource-2.9.7-8.el8.aarch64.rpm SHA-256: f111abbb30ada25ecbd29521cba20d78fec0e2fc6e1f1bdaad28e89d308394ca
libxml2-debugsource-2.9.7-8.el8.aarch64.rpm SHA-256: f111abbb30ada25ecbd29521cba20d78fec0e2fc6e1f1bdaad28e89d308394ca
libxml2-devel-2.9.7-8.el8.aarch64.rpm SHA-256: e6fc73af7559228adea2fc956cf2539e7b1a0ddcc48953cb511e914a866391d4
python3-libxml2-2.9.7-8.el8.aarch64.rpm SHA-256: 853a828e0d2fa57b69ee46167f0c54dbeba977043f18b03f8912412204d3b8dc
python3-libxml2-debuginfo-2.9.7-8.el8.aarch64.rpm SHA-256: 130fbf9b3de2de0aca5c28ab030e036b2eddb5eaf79217991dc6a07e1e6f5098
python3-libxml2-debuginfo-2.9.7-8.el8.aarch64.rpm SHA-256: 130fbf9b3de2de0aca5c28ab030e036b2eddb5eaf79217991dc6a07e1e6f5098

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.