{"id":"CVE-2018-14567","title":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-803…","summary":"libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-803…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-835","CWE-400"],"vendor":"xmlsoft","product":"libxml2","affected":["libxml2 = 2.9.8","ubuntu_linux = 14.04","ubuntu_linux = 16.04","ubuntu_linux = 18.04","debian_linux = 8.0"],"published":"2018-08-16","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:16:43.043","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-14567","references":[{"url":"http://www.securityfocus.com/bid/105198","label":"cve@mitre.org"},{"url":"https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3739-1/","label":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/105198","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3739-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-14567.json"},{"url":"https://access.redhat.com/security/cve/CVE-2018-14567"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1619875"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14567"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14567"},{"url":"https://access.redhat.com/errata/RHSA-2020:1190"},{"url":"https://access.redhat.com/errata/RHBA-2020:1539"},{"url":"https://access.redhat.com/errata/RHBA-2020:1540"}],"tags":["nvd","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.04294,"epssPercentile":0.91077,"ingestedAt":"2026-10-14T07:21:04.802Z","patched":["enterprise_linux_client_v_7","enterprise_linux_client_optional_v_7","enterprise_linux_computenode_v_7","enterprise_linux_computenode_optional_v_7","enterprise_linux_server_v_7","ansible_tower_3_5_for_rhel_7_server","ansible_tower_3_6_for_rhel 7","enterprise_linux_server_optional_v_7","enterprise_linux_workstation_v_7","enterprise_linux_workstation_optional_v_7"],"scores":{"nvd":6.5,"vendor":4.3},"slug":"CVE-2018-14567","body":"## Overview\n\nlibxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.\n\n## Affected\n\n- `libxml2 = 2.9.8`\n- `ubuntu_linux = 14.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `debian_linux = 8.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2020:1190** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), … · released 2020-03-31 · [advisory](https://access.redhat.com/errata/RHSA-2020:1190)\n- **RHBA-2020:1539** · Red Hat · fixed in: Red Hat Ansible Tower 3.5 for RHEL 7 Server · released 2020-04-22 · [advisory](https://access.redhat.com/errata/RHBA-2020:1539)\n- **RHBA-2020:1540** · Red Hat · fixed in: Red Hat Ansible Tower 3.6 for RHEL 7 · released 2020-04-22 · [advisory](https://access.redhat.com/errata/RHBA-2020:1540)\n- **Red Hat VEX** · Low · affected: Red Hat Virtualization 4 · no fix planned: Red Hat Virtualization 4 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-14567.json)","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":35.8,"likelihood":0.9,"exploitation":0,"ransomware":0},"changes":[]}