search

joshnewton31080 / dvna

MIT License
0 stars 0 forks source link

CVE-2019-19956 (High) detected in https://source.codeaurora.org/quic/la/platform/external/libxml2/LA.UM.6.6.c27-04000-89xx.0 #2

Open mend-for-github-com[bot] opened 3 years ago

mend-for-github-com[bot] commented 3 years ago

CVE-2019-19956 - High Severity Vulnerability

Vulnerable Library - https://source.codeaurora.org/quic/la/platform/external/libxml2/LA.UM.6.6.c27-04000-89xx.0

Library home page: https://source.codeaurora.org/quic/la/platform/external/libxml2/

Found in HEAD commit: ebbe518de6103063656cb8a1c3d1040aacb09826

Found in base branch: main

Vulnerable Source Files (1)

dvna/node_modules/libxmljs/vendor/libxml/parser.c

Vulnerability Details

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

Publish Date: 2019-12-24

URL: CVE-2019-19956

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: https://github.com/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549

Release Date: 2019-08-26

Fix Resolution: Replace or update the following file: parser.c