---
id: CVE-2018-14567
title: >-
  libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a
  denial of service (infinite loop) via a crafted XML file that triggers
  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability
  than CVE-2015-803…
summary: >-
  libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a
  denial of service (infinite loop) via a crafted XML file that triggers
  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability
  than CVE-2015-803…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
  - CWE-400
vendor: xmlsoft
product: libxml2
affected:
  - libxml2 = 2.9.8
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - debian_linux = 8.0
published: '2018-08-16'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:43.043'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-14567'
references:
  - url: 'http://www.securityfocus.com/bid/105198'
    label: cve@mitre.org
  - url: >-
      https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/3739-1/'
    label: cve@mitre.org
  - url: 'http://www.securityfocus.com/bid/105198'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/3739-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-14567.json
  - url: 'https://access.redhat.com/security/cve/CVE-2018-14567'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1619875'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2018-14567'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2018-14567'
  - url: 'https://access.redhat.com/errata/RHSA-2020:1190'
  - url: 'https://access.redhat.com/errata/RHBA-2020:1539'
  - url: 'https://access.redhat.com/errata/RHBA-2020:1540'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.04294
epssPercentile: 0.91077
ingestedAt: '2026-10-14T07:21:04.802Z'
patched:
  - enterprise_linux_client_v_7
  - enterprise_linux_client_optional_v_7
  - enterprise_linux_computenode_v_7
  - enterprise_linux_computenode_optional_v_7
  - enterprise_linux_server_v_7
  - ansible_tower_3_5_for_rhel_7_server
  - ansible_tower_3_6_for_rhel 7
  - enterprise_linux_server_optional_v_7
  - enterprise_linux_workstation_v_7
  - enterprise_linux_workstation_optional_v_7
scores:
  nvd: 6.5
  vendor: 4.3
---

## Overview

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

## Affected

- `libxml2 = 2.9.8`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `debian_linux = 8.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2020:1190** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Server Optional (v. 7), … · released 2020-03-31 · [advisory](https://access.redhat.com/errata/RHSA-2020:1190)
- **RHBA-2020:1539** · Red Hat · fixed in: Red Hat Ansible Tower 3.5 for RHEL 7 Server · released 2020-04-22 · [advisory](https://access.redhat.com/errata/RHBA-2020:1539)
- **RHBA-2020:1540** · Red Hat · fixed in: Red Hat Ansible Tower 3.6 for RHEL 7 · released 2020-04-22 · [advisory](https://access.redhat.com/errata/RHBA-2020:1540)
- **Red Hat VEX** · Low · affected: Red Hat Virtualization 4 · no fix planned: Red Hat Virtualization 4 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-14567.json)