CVE-2020-24977

Published: Sep 4, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

Affected (26)

Products: Xmlsoft: Libxml2 · Debian: Debian Linux · Fedoraproject: Fedora · +3 more

Show all products

1 product

1 product

1 product

1 product

7 products

Active Iq Unified Manager

Clustered Data Ontap

Clustered Data Ontap Antivirus Connector

Inventory Collect Tool

Manageability Software Development Kit

Snapdrive

Hci H410c Firmware

Oracle

7 products

Communications Cloud Native Core Network Function Cloud Native Environment

Enterprise Manager Base Platform

Enterprise Manager Ops Center

Http Server

Mysql Workbench

Peoplesoft Enterprise Peopletools

Real User Experience Insight

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml2	Version 2.9.10

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Configuration E

8 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	From 9.5
Netapp Active Iq Unified Manager	From 7.3
Netapp Clustered Data Ontap	All versions
Netapp Clustered Data Ontap Antivirus Connector	All versions
Netapp Inventory Collect Tool	All versions
Netapp Manageability Software Development Kit	All versions
Netapp Snapdrive	All versions
Netapp Snapdrive	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Hci H410c Firmware	All versions

Running on/with	Platform Versions
Netapp Hci H410c	All versions

Configuration G

10 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Version 1.10.0
Oracle Enterprise Manager Base Platform	Version 13.4.0.0
Oracle Enterprise Manager Base Platform	Version 13.5.0.0
Oracle Enterprise Manager Ops Center	Version 12.4.0.0
Oracle Http Server	Version 12.2.1.3.0
Oracle Http Server	Version 12.2.1.4.0
Oracle Mysql Workbench	Up to 8.0.26
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Real User Experience Insight	Version 13.4.1.0
Oracle Real User Experience Insight	Version 13.5.1.0

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (48)

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2

Source: cve@mitre.org

PatchVendor Advisory

https://gitlab.gnome.org/GNOME/libxml2/-/issues/178

Source: cve@mitre.org

ExploitIssue TrackingPatchVendor Advisory

https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html

Source: cve@mitre.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KTUAGDLEHTH6HU66HBFAFTSQ3OKRAN3/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/674LQPJO2P2XTBTREFR5LOZMBTZ4PZAY/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENEHQIBMSI6TZVS35Y6I4FCTYUQDLJVP/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3ICASXZI2UQYFJAOQWHSTNWGED3VXOE/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCHXIWR5DHYO3RSO7RAHEC6VJKXD2EH2/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7MEWYKIKMV2SKMGH4IDWVU3ZGJXBCPQ/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RIQAMBA2IJUTQG5VOP5LZVIZRNCKXHEQ/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202107-05

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200924-0001/

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200924-0001/

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200924-0001/

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200924-0001/

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: cve@mitre.org

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html