Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Red Hat Hardened Images | affected |
|
||||||
| Red Hat | Red Hat Enterprise Linux 10 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 10 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 6 | unknown | — | ||||||
| Red Hat | Red Hat Enterprise Linux 7 | unknown | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 8 | affected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | unaffected | — | ||||||
| Red Hat | Red Hat Enterprise Linux 9 | affected | — | ||||||
| Red Hat | Red Hat Hardened Images | unaffected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — | ||||||
| Red Hat | Red Hat OpenShift Container Platform 5 | affected | — |
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Redhat | Enterprise Linux |
|
||||||||
| Redhat | Hardened Images |
|
||||||||
| Redhat | Libxml2 |
|
||||||||
| Redhat | Openshift Container Platform |
|
Vendor Workaround
To mitigate this issue, avoid processing untrusted XML catalog files with applications linked against libxml2. Users should exercise caution when opening or processing XML documents from untrusted sources, as a malicious catalog could lead to application crashes. Where possible, restrict the ability of applications to load external XML catalogs, or ensure that only trusted catalog files are used.
| Source | ID | Title |
|---|---|---|
Ubuntu USN |
USN-8910-1 | libxml2 vulnerabilities |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.157% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Els
|
|
| CPEs | cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
cpe:/a:redhat:enterprise_linux:10 cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:rhel_els:6 cpe:/o:redhat:rhel_els:7 |
| Vendors & Products |
Redhat rhel Els
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:openshift:5 |
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat hardened Images
Redhat libxml2 Redhat openshift Container Platform |
|
| Vendors & Products |
Redhat hardened Images
Redhat libxml2 Redhat openshift Container Platform |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS). | |
| Title | Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute | |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat hummingbird Redhat openshift |
|
| Weaknesses | CWE-476 | |
| CPEs | cpe:/a:redhat:hummingbird:1 cpe:/a:redhat:openshift:4 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat hummingbird Redhat openshift |
|
| References |
| |
| Metrics |
cvssV3_1
|