QID 198409

Date Published: 2021-06-23

QID 198409: Ubuntu Security Notification for libxml2 vulnerabilities (USN-4991-1)

Libxml2 incorrectly handled certain error conditions.
Libxml2 incorrectly handled certain xml schemas.
Libxml2 incorrectly handled invalid utf-8 input.
Libxml2 did not properly handle certain crafted xml files.
Libxml2 incorrectly handled error states.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

a remote attacker could exploit this with a crafted xml file to cause a denial of service, or possibly cause libxml2 to expose sensitive information.
This issue only affected ubuntu 14.04 esm, and ubuntu 16.04 esm. (
cve-2017-8872).
A remote attacker could possibly use this issue to cause a denial of service.
This issue only affected ubuntu 14.04 esm, ubuntu 16.04 esm, and ubuntu 18.04 lts. (
cve-2019-20388).
A remote attacker could possibly exploit this with a crafted xml file to cause libxml2 to crash, resulting in a denial of service.
This issue only affected ubuntu 14.04 esm, ubuntu 16.04 esm, ubuntu 18.04 lts, ubuntu 20.04 lts and ubuntu 20.10. (
cve-2020-24977).
A remote attacker could possibly exploit this with a crafted xml file to cause libxml2 to crash, resulting in a denial of service. (
cve-2021-3517).
A local attacker could exploit this with a crafted input to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (
cve-2021-3516, cve-2021-3518).
A remote attacker could exploit this with a crafted xml file to cause libxml2 to crash, resulting in a denial of service. (
cve-2021-3537).
A remote attacker could exploit this with a crafted xml file to cause libxml2 to crash, resulting in a denial of service.
This issue only affected ubuntu 20.04 lts, ubuntu 20.10, and ubuntu 21.04.
(cve-2021-3541).

  • CVSS V3 rated as Critical - 9.1 severity.
  • CVSS V2 rated as High - 7.5 severity.
  • Solution
    Refer to Ubuntu advisory: USN-4991-1 for affected packages and patching details, or update with your package manager.
    Vendor References
    Software Advisories
    Advisory ID Software Component Link
    USN-4991-1 Ubuntu Linux URL Logo usn.ubuntu.com/4991-1