CVE-2020-24977

תיאור (מקור, אנגלית)

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

מדדים

CVSS 3.1

6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS — סבירות ניצול

3% (אחוזון 100) נכון ל-14/10/2026

CWE

CWE-125

מוצרים מושפעים

xmlsoft: libxml2; debian: debian linux; fedoraproject: fedora; opensuse: leap; netapp: active iq unified manager; netapp: clustered data ontap; netapp: clustered data ontap antivirus connector; netapp: inventory collect tool; netapp: manageability software development kit; netapp: snapdrive; netapp: hci h410c firmware; netapp: hci h410c; oracle: communications cloud native core network function cloud native environment; oracle: enterprise manager base platform; oracle: enterprise manager ops center

קישורים

• https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca0‮… PatchVendor Advisory
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/178 ExploitIssue TrackingPatchVendor Advisory
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca0‮… PatchVendor Advisory
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/178 ExploitIssue TrackingPatchVendor Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html Mailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html Mailing ListThird Party Advisory