// For flags

CVE-2020-7595

libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

La función xmlStringLenDecodeEntities en el archivo parser.c en libxml2 versión 2.9.10, presenta un bucle infinito en una determinada situación de fin del archivo.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-21 CVE Reserved
  • 2020-01-21 CVE Published
  • 2024-05-16 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CAPEC
References (17)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Netapp
Search vendor "Netapp"
H300s Firmware
Search vendor "Netapp" for product "H300s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H300s
Search vendor "Netapp" for product "H300s"
--
Safe
Netapp
Search vendor "Netapp"
H500s Firmware
Search vendor "Netapp" for product "H500s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H500s
Search vendor "Netapp" for product "H500s"
--
Safe
Netapp
Search vendor "Netapp"
H700s Firmware
Search vendor "Netapp" for product "H700s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H700s
Search vendor "Netapp" for product "H700s"
--
Safe
Netapp
Search vendor "Netapp"
H300e Firmware
Search vendor "Netapp" for product "H300e Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H300e
Search vendor "Netapp" for product "H300e"
--
Safe
Netapp
Search vendor "Netapp"
H500e Firmware
Search vendor "Netapp" for product "H500e Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H500e
Search vendor "Netapp" for product "H500e"
--
Safe
Netapp
Search vendor "Netapp"
H700e Firmware
Search vendor "Netapp" for product "H700e Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H700e
Search vendor "Netapp" for product "H700e"
--
Safe
Netapp
Search vendor "Netapp"
H410s Firmware
Search vendor "Netapp" for product "H410s Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H410s
Search vendor "Netapp" for product "H410s"
--
Safe
Netapp
Search vendor "Netapp"
H410c Firmware
Search vendor "Netapp" for product "H410c Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
H410c
Search vendor "Netapp" for product "H410c"
--
Safe
Xmlsoft
Search vendor "Xmlsoft"
Libxml2
Search vendor "Xmlsoft" for product "Libxml2"
2.9.10
Search vendor "Xmlsoft" for product "Libxml2" and version "2.9.10"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
30
Search vendor "Fedoraproject" for product "Fedora" and version "30"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
31
Search vendor "Fedoraproject" for product "Fedora" and version "31"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
32
Search vendor "Fedoraproject" for product "Fedora" and version "32"
-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
12.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"
-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
14.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04"
esm
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
16.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04"
lts
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
18.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04"
lts
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
19.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "19.10"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
9.0
Search vendor "Debian" for product "Debian Linux" and version "9.0"
-
Affected
Siemens
Search vendor "Siemens"
Sinema Remote Connect Server
Search vendor "Siemens" for product "Sinema Remote Connect Server"
< 3.0
Search vendor "Siemens" for product "Sinema Remote Connect Server" and version " < 3.0"
-
Affected
Netapp
Search vendor "Netapp"
Clustered Data Ontap
Search vendor "Netapp" for product "Clustered Data Ontap"
--
Affected
Netapp
Search vendor "Netapp"
Smi-s Provider
Search vendor "Netapp" for product "Smi-s Provider"
--
Affected
Netapp
Search vendor "Netapp"
Snapdrive
Search vendor "Netapp" for product "Snapdrive"
-windows
Affected
Netapp
Search vendor "Netapp"
Steelstore Cloud Integrated Storage
Search vendor "Netapp" for product "Steelstore Cloud Integrated Storage"
--
Affected
Netapp
Search vendor "Netapp"
Symantec Netbackup
Search vendor "Netapp" for product "Symantec Netbackup"
--
Affected
Oracle
Search vendor "Oracle"
Real User Experience Insight
Search vendor "Oracle" for product "Real User Experience Insight"
13.3.1.0
Search vendor "Oracle" for product "Real User Experience Insight" and version "13.3.1.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Network Function Cloud Native Environment
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment"
1.10.0
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment" and version "1.10.0"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Manager Base Platform
Search vendor "Oracle" for product "Enterprise Manager Base Platform"
13.4.0.0
Search vendor "Oracle" for product "Enterprise Manager Base Platform" and version "13.4.0.0"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Manager Base Platform
Search vendor "Oracle" for product "Enterprise Manager Base Platform"
13.5.0.0
Search vendor "Oracle" for product "Enterprise Manager Base Platform" and version "13.5.0.0"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Manager Ops Center
Search vendor "Oracle" for product "Enterprise Manager Ops Center"
12.4.0.0
Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.4.0.0"
-
Affected
Oracle
Search vendor "Oracle"
Mysql Workbench
Search vendor "Oracle" for product "Mysql Workbench"
<= 8.0.26
Search vendor "Oracle" for product "Mysql Workbench" and version " <= 8.0.26"
-
Affected
Oracle
Search vendor "Oracle"
Peoplesoft Enterprise Peopletools
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools"
8.58
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.58"
-
Affected
Oracle
Search vendor "Oracle"
Real User Experience Insight
Search vendor "Oracle" for product "Real User Experience Insight"
13.4.1.0
Search vendor "Oracle" for product "Real User Experience Insight" and version "13.4.1.0"
-
Affected
Oracle
Search vendor "Oracle"
Real User Experience Insight
Search vendor "Oracle" for product "Real User Experience Insight"
13.5.1.0
Search vendor "Oracle" for product "Real User Experience Insight" and version "13.5.1.0"
-
Affected