CVE-2018-14567

Vulnerability

libxml2 versions up to and including 2.9.8, when compiled with --with-lzma, contain an infinite loop vulnerability triggered by a crafted XML file that causes an LZMA_MEMLIMIT_ERROR during decompression. The bug is demonstrated with the xmllint utility and affects the library itself, not only the command-line tool. This issue is distinct from CVE-2015-8035 and CVE-2018-9251 [1].

Exploitation

An attacker requires no authentication or special network position; they only need to deliver a specially crafted XML file that, when processed by an application using libxml2's LZMA decompression path, causes an LZMA_MEMLIMIT_ERROR leading to an infinite loop. This can be achieved remotely by submitting a malicious XML document to a service that parses user-supplied XML, such as a web application or document parser [1].

Impact

Successful exploitation results in an infinite loop condition, causing the affected application or service to hang indefinitely. This constitutes a denial of service (DoS) as the resource becomes unresponsive, consuming CPU time until manually terminated. No code execution or data disclosure is associated with this vulnerability [1].

Mitigation

Ubuntu published security update USN-3739-1 on August 16, 2018, which upgrades libxml2 to version 2.9.8+dfsg2-5ubuntu1.2 for Ubuntu 18.04 LTS and corresponding versions for other releases [1]. Users should apply the update or rebuild libxml2 without --with-lzma as a workaround. The fix commit is available in the upstream repository [2]. No public KEV listing exists.