Denial of Service Vulnerability in libxml2: Infinite Loop Risk
Summary
ALPINE-CVE-2018-9251: The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated b... Affects libxml2 versions < 2.9.8-r1. Fixed in 2.9.8-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely-used XML parsing library that provides a range of functionalities for processing XML documents. It is known for its speed and efficiency, making it a popular choice for applications requiring XML parsing. However, libxml2 has a vulnerability that can lead to denial of service under specific conditions, particularly when the library is compiled with LZMA support.
Vulnerability Detail
The vulnerability arises from the xz_decomp function in xzlib.c within libxml2 version 2.9.8. If the library is compiled with the --with-lzma option, it becomes susceptible to a crafted XML file that triggers an infinite loop due to LZMA_MEMLIMIT_ERROR. This can lead to a denial of service, as the affected application may become unresponsive when processing such malicious XML files. The vulnerability is distinct from CVE-2015-8035 and poses a risk to any application utilizing libxml2 for XML parsing.
How To Fix
Minimum fixed version
2.9.8-r1
This is the first release that contains the fix.
sudo apk add --upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling LZMA support during the compilation of libxml2 by omitting the --with-lzma option. This will prevent the vulnerability from being triggered by crafted XML files.
Conclusion
The vulnerability in libxml2 poses a significant risk of denial of service due to an infinite loop triggered by specific crafted XML files. It is crucial for users of libxml2 to update to the patched version or implement workarounds to safeguard their applications.
See every vulnerability recorded for libxml2 →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary consequence is denial of service, where the application may become unresponsive when processing malicious XML files.
Yes, updating to libxml2 version 2.9.8-r1 or later will mitigate the vulnerability.
As a temporary measure, you can disable LZMA support during compilation to avoid triggering the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
