CVE-2020-24977medium
Description
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
References
https://gitlab.gnome.org/GNOME/libxml2/-/issues/178
https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html
https://security.netapp.com/advisory/ntap-20200924-0001/
https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
https://lists.apache.org/thread.html/[email protected]%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202107-05
https://www.oracle.com/security-alerts/cpuoct2021.html
Details
Source: MITRE
Published: 2020-09-04
Updated: 2022-07-25
Type: CWE-125
Risk Information
CVSS v2
Base Score: 6.4
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Impact Score: 4.9
Exploitability Score: 10
Severity: MEDIUM
CVSS v3
Base Score: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Impact Score: 2.5
Exploitability Score: 3.9
Severity: MEDIUM