What’s Vulnerable › Vulnerabilities
CVE-2019-20388
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-01-21 · updated 2026-10-14
- Weakness: CWE-401
Description
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
Affected products
- Debian Linux: 9.0
- Fedoraproject Fedora: 30, 31, 32
- NetApp Cloud Backup: all versions
- Clustered Data ONTAP: all versions
- NetApp H300E Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500E Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700E Firmware: all versions
- NetApp H700S Firmware: all versions
- NetApp ONTAP Select Deploy administration utility: all versions
- NetApp Plug-In For Symantec Netbackup: all versions
- NetApp Smi-S Provider: all versions
- NetApp Snapdrive: all versions
- NetApp Steelstore Cloud Integrated Storage: all versions
- openSUSE Leap: 15.1
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
- Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0, 13.5.0.0
- Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
- Oracle Corporation MySQL Workbench: through 8.0.26
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58
- Oracle Real User Experience Insight: 13.3.1.0, 13.4.1.0, 13.5.1.0
- xmlsoft libxml2: 2.9.10
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html
- https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68
- https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/
- https://security.gentoo.org/glsa/202010-04
- https://security.netapp.com/advisory/ntap-20200702-0005/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Get alerted when CVE-2019-20388 or the next vulnerability affects your stack