CVE-2019-20388 | BDVDB-2026-129484 Detail
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Description#
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
- CWE-401 Missing Release of Memory after Effective Lifetime
References#
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68
- https://security.netapp.com/advisory/ntap-20200702-0005/
- https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html
- https://security.gentoo.org/glsa/202010-04
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.