01 Record

CVE-2020-24977

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 2.97% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 87.2% of scored records. A rank, not a probability.
NVD base score: 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
NVD analysis status: Modified. NVD last modified this record on 2026-10-14.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2020-09-03 23:20Z6 YR AGO

Last updated

2026-10-14 09:35Z15 DAYS AGO

Reserved

2020-08-28

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-125Out-of-bounds ReadBase
CWE-787Out-of-bounds WriteBase

Data version

5.2

Document digest

4bcc9ba273049cf889680b2826976903d0407e3663421dbe9a76f5536cd8075a

05 Affected products

VendorProductVersionsPlatforms

debiandebian_linuxNot specified—

fedoraprojectfedoraNot specified—

netappactive_iq_unified_managerNot specified—

netappclustered_data_ontapNot specified—

netappclustered_data_ontap_antivirus_connectorNot specified—

netapphci_h410cNot specified—

netapphci_h410c_firmwareNot specified—

netappinventory_collect_toolNot specified—

netappmanageability_software_development_kitNot specified—

netappsnapdriveNot specified—

opensuseleapNot specified—

oraclecommunications_cloud_native_core_network_function_cloud_native_environmentNot specified—

oracleenterprise_manager_base_platformNot specified—

oracleenterprise_manager_ops_centerNot specified—

oraclehttp_serverNot specified—

oraclemysql_workbenchNot specified—

oraclepeoplesoft_enterprise_peopletoolsNot specified—

oraclereal_user_experience_insightNot specified—

redhatenterprise_linuxNot specified—

redhatjboss_core_servicesNot specified—

xmlsoftlibxml2Not specified—

06 References

gitlab.gnome.orghttps://gitlab.gnome.org/GNOME/libxml2/-/issues/178x_refsource_MISC
lists.debian.org[debian-lts-announce] 20200909 [SECURITY] [DLA 2369-1] libxml2 security updatehttps://lists.debian.org/debian-lts-announce/2020/09/msg00009.htmlmailing-listx_refsource_MLIST
lists.opensuse.orgopenSUSE-SU-2020:1430http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.htmlvendor-advisoryx_refsource_SUSE
lists.fedoraproject.orgFEDORA-2020-35087800behttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/vendor-advisoryx_refsource_FEDORA
lists.opensuse.orgopenSUSE-SU-2020:1465http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.htmlvendor-advisoryx_refsource_SUSE
lists.fedoraproject.orgFEDORA-2020-7dd29dacadhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2020-b60dbdd538https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7MEWYKIKMV2SKMGH4IDWVU3ZGJXBCPQ/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2020-be489044dfhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2020-dd2fc19b78https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCHXIWR5DHYO3RSO7RAHEC6VJKXD2EH2/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2020-20ab468a33https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3ICASXZI2UQYFJAOQWHSTNWGED3VXOE/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2020-935f62c3d9https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENEHQIBMSI6TZVS35Y6I4FCTYUQDLJVP/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2020-7773c53bc8https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RIQAMBA2IJUTQG5VOP5LZVIZRNCKXHEQ/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2020-ff317550e4https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KTUAGDLEHTH6HU66HBFAFTSQ3OKRAN3/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2020-b6aaf25741https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/674LQPJO2P2XTBTREFR5LOZMBTZ4PZAY/vendor-advisoryx_refsource_FEDORA
lists.apache.org[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jarhttps://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Emailing-listx_refsource_MLIST
security.gentoo.orgGLSA-202107-05https://security.gentoo.org/glsa/202107-05vendor-advisoryx_refsource_GENTOO
www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
security.netapp.comhttps://security.netapp.com/advisory/ntap-20200924-0001/x_refsource_CONFIRM
gitlab.gnome.orghttps://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2x_refsource_MISC
www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.htmlx_refsource_MISC
www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.htmlx_refsource_MISC
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html

07 Fixed in

Arch Linux

libxml2
Fixed in 2.9.10-6

Source: Arch Linux Security Tracker, the Arch Linux security team. Reformatted by exploit.cc.

Debian 12

libxml2
Fixed in 2.9.10+dfsg-6.2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

libxml2
Fixed in 2.9.10+dfsg-6.2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

libxml2
Fixed in 2.9.10+dfsg-6.2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

libxml2
Fixed in 2.9.4+dfsg1-6.1ubuntu1.4

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

libxml2
Fixed in 2.9.10+dfsg-5ubuntu0.20.04.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 14.04 LTS

libxml2
Fixed in 2.9.1+dfsg1-3ubuntu4.13+esm2
Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 16.04 LTS

libxml2
Fixed in 2.9.3+dfsg1-1ubuntu0.7+esm1
Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.