CVE-2018-14404

Vulnerability

A NULL pointer dereference vulnerability exists in the xmlXPathCompOpEval() function in xpath.c of libxml2 through version 2.9.8 [1][2]. The issue occurs when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case [1]. Applications that process untrusted XSL format inputs using the libxml2 library may be affected [1].

Exploitation

An attacker needs to supply a crafted XSL or XPath input to an application that uses libxml2 for parsing [1]. The attack does not require authentication if the application accepts untrusted input over the network or from local files. The vulnerable code path is triggered when the XPath expression is evaluated, leading to a dereference of a null pointer [1].

Impact

Successful exploitation causes a crash of the application due to a NULL pointer dereference, resulting in a denial of service (DoS) condition [1][3][4]. No code execution or privilege escalation is reported; the impact is limited to availability [1].

Mitigation

Red Hat released an update for libxml2 as part of RHSA-2019:1543 on June 18, 2019, which addresses this issue [3]. Ubuntu released updates in USN-3739-1 (for Ubuntu 18.04 LTS and other releases) on August 14, 2018, and USN-3739-2 (for Ubuntu 12.04) on the same date [2][4]. Users should update libxml2 to the fixed versions provided by their respective vendors. No workarounds are described in the available references.