What’s Vulnerable › Vulnerabilities
CVE-2020-24977
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-09-04 · updated 2026-10-14
- Weakness: CWE-125
Description
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
Affected products
- Debian Linux: 9.0
- Fedoraproject Fedora: 31, 32, 33
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
- Clustered Data ONTAP: all versions
- NetApp Clustered Data Ontap Antivirus Connector: all versions
- NetApp Hci H410C Firmware: all versions
- NetApp Inventory Collect Tool: all versions
- NetApp Manageability Software Development Kit: all versions
- NetApp Snapdrive: all versions
- openSUSE Leap: 15.1, 15.2
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
- Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0, 13.5.0.0
- Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
- Oracle Corporation Oracle HTTP Server: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation MySQL Workbench: through 8.0.26
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58
- Oracle Real User Experience Insight: 13.4.1.0, 13.5.1.0
- xmlsoft libxml2: 2.9.10
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/178
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KTUAGDLEHTH6HU66HBFAFTSQ3OKRAN3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/674LQPJO2P2XTBTREFR5LOZMBTZ4PZAY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENEHQIBMSI6TZVS35Y6I4FCTYUQDLJVP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/
Get alerted when CVE-2020-24977 or the next vulnerability affects your stack