Medium: libxml2

Issue Overview:

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e. (CVE-2020-24977)

There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application. (CVE-2021-3517)

A flaw exists in libxml2 which allows for an exponential entity expansion attack which can bypass existing protection mechanisms leading to a potential denial of service. (CVE-2021-3541)

Affected Packages:

libxml2

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update libxml2 to update your system.

New Packages:

aarch64:  
    libxml2-2.9.1-6.amzn2.5.3.aarch64  
    libxml2-devel-2.9.1-6.amzn2.5.3.aarch64  
    libxml2-static-2.9.1-6.amzn2.5.3.aarch64  
    libxml2-python-2.9.1-6.amzn2.5.3.aarch64  
    libxml2-debuginfo-2.9.1-6.amzn2.5.3.aarch64  
  
i686:  
    libxml2-2.9.1-6.amzn2.5.3.i686  
    libxml2-devel-2.9.1-6.amzn2.5.3.i686  
    libxml2-static-2.9.1-6.amzn2.5.3.i686  
    libxml2-python-2.9.1-6.amzn2.5.3.i686  
    libxml2-debuginfo-2.9.1-6.amzn2.5.3.i686  
  
src:  
    libxml2-2.9.1-6.amzn2.5.3.src  
  
x86_64:  
    libxml2-2.9.1-6.amzn2.5.3.x86_64  
    libxml2-devel-2.9.1-6.amzn2.5.3.x86_64  
    libxml2-static-2.9.1-6.amzn2.5.3.x86_64  
    libxml2-python-2.9.1-6.amzn2.5.3.x86_64  
    libxml2-debuginfo-2.9.1-6.amzn2.5.3.x86_64  

Additional References

Red Hat: CVE-2020-24977, CVE-2021-3517, CVE-2021-3541

Mitre: CVE-2020-24977, CVE-2021-3517, CVE-2021-3541