CVE-2018-14404.yml

---
gem: nokogiri
cve: 2018-14404
ghsa: 6qvp-r6r3-9p7h
url: https://github.com/sparklemotion/nokogiri/issues/1785
title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
date: 2018-10-04
description: |
  Nokogiri 1.8.5 has been released.

  This is a security and bugfix release. It addresses two CVEs in upstream
  libxml2 rated as "medium" by Red Hat, for which details are below.

  If you're using your distro's system libraries, rather than Nokogiri's
  vendored libraries, there's no security need to upgrade at this time,
  though you may want to check with your distro whether they've patched this
  (Canonical has patched Ubuntu packages). Note that these patches are not
  yet (as of 2018-10-04) in an upstream release of libxml2.

  Full details about the security update are available in Github Issue #1785.
  [#1785]: https://github.com/sparklemotion/nokogiri/issues/1785

  -----

  [MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404
  and CVE-2018-14567. Full details are available in #1785. Note that these
  patches are not yet (as of 2018-10-04) in an upstream release of libxml2.

  -----

  CVE-2018-14404

  Permalink:

  https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html

  Description:

  A NULL pointer dereference vulnerability exists in the
  xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when
  parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR
  case. Applications processing untrusted XSL format inputs with the use of
  the libxml2 library may be vulnerable to a denial of service attack due
  to a crash of the application

  Canonical rates this vulnerability as "Priority: Medium"

  -----

  CVE-2018-14567

  Permalink:

  https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html

  Description:

  infinite loop in LZMA decompression

  Canonical rates this vulnerability as "Priority: Medium"
cvss_v3: 7.5
patched_versions:
  - ">= 1.8.5"
related:
  cve:
    - 2018-14567
  url:
    - https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ
    - https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594
    - https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74