GNOME libxml2 up to 2.9.10 libxml2/entities.c xmlEncodeEntitiesInternal buffer overflow

Summaryinfo

A vulnerability was found in GNOME libxml2 up to 2.9.10. It has been classified as critical. This issue affects the function xmlEncodeEntitiesInternal of the file libxml2/entities.c. Performing a manipulation results in buffer overflow. This vulnerability is known as CVE-2020-24977. Remote exploitation of the attack is possible. No exploit is available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in GNOME libxml2 up to 2.9.10 (Document Processing Software). This affects the function xmlEncodeEntitiesInternal of the file libxml2/entities.c. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

GNOME project libxml2 v2.9.10 and earlier have a global Buffer Overflow vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 8e7c20a1 (20910-GITv2.9.10-103-g8e7c20a1).

The weakness was published 09/04/2020 by Suhwan Song as xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal as confirmed issue (Website). The advisory is shared at gitlab.gnome.org. The public release has been coordinated with GNOME. This vulnerability is uniquely identified as CVE-2020-24977 since 08/28/2020. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The reason for this vulnerability is this part of code:

if (*cur < 0xC0) {

The vulnerability scanner Nessus provides a plugin with the ID 236689 (Alibaba Cloud Linux 3 : 0018: libxml2 (ALINUX3-SA-2022:0018)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 20910-GITv2.9.10-103-g8e7c20a1 eliminates this vulnerability. Applying the patch 8e7c20a1 is able to eliminate this problem. The best possible mitigation is suggested to be patching the affected component. The vulnerability will be addressed with the following lines of code:

if (((cur[0] & 0xC0) != 0xC0) ||
	((cur[1] & 0xC0) != 0x80) ||
	(((cur[0] & 0xE0) == 0xE0) && ((cur[2] & 0xC0) != 0x80)) ||
	(((cur[0] & 0xF0) == 0xF0) && ((cur[3] & 0xC0) != 0x80)) ||
	(((cur[0] & 0xF8) == 0xF8))) {

The vulnerability is also documented in the vulnerability database at Tenable (236689). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Document Processing Software

Vendor

• GNOME

Name

• libxml2

Version

• 2.9.0
• 2.9.1
• 2.9.2
• 2.9.3
• 2.9.4
• 2.9.5
• 2.9.6
• 2.9.7
• 2.9.8
• 2.9.9
• 2.9.10

License

• open-source

Website

• Vendor: https://www.gnome.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion