CVE-2020-24977
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
- CVSS 3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-25)
- CWE
- CWE-125
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fedoraproject:fedora
- netapp:active_iq_unified_manager
- netapp:clustered_data_ontap
- netapp:clustered_data_ontap_antivirus_connector
- netapp:hci_h410c_firmware
- netapp:inventory_collect_tool
- netapp:manageability_software_development_kit
- netapp:snapdrive
- opensuse:leap
- oracle:communications_cloud_native_core_network_function_cloud_native_environment
- oracle:enterprise_manager_base_platform
- oracle:enterprise_manager_ops_center
- oracle:http_server
- oracle:mysql_workbench
- oracle:peoplesoft_enterprise_peopletools
- oracle:real_user_experience_insight
- xmlsoft:libxml2
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/178
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E