CVE-2020-24977: Buffer Overflow
GNOME libxml2 is vulnerable to a buffer overflow, caused by improper bounds checking by the xmlEncodeEntitiesInternal function in libxml2/entities.c. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system.
Other sources
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2020-24977.
What is the severity of CVE-2020-24977?
The severity of CVE-2020-24977 is high with a CVSS score of 7.8.
What is the affected software of CVE-2020-24977?
The affected software includes IBM Security Verify Access, Xmlsoft Libxml2, Debian Debian Linux, Fedoraproject Fedora, openSUSE Leap, NetApp products, Apple watchOS, Apple iPadOS, Apple macOS Big Sur, Oracle products, and others.
How does CVE-2020-24977 exploit the vulnerability?
CVE-2020-24977 exploits a buffer overflow vulnerability in the xmlEncodeEntitiesInternal function in libxml2/entities.c by persuading a victim to open a specially-crafted file, allowing a remote attacker to execute arbitrary code on the system.
Is there a fix available for CVE-2020-24977?
Yes, a fix is available for CVE-2020-24977. It is recommended to update to the latest version of the affected software or apply the necessary patches provided by the vendor.