ZeroDay Findings
Sign inSign up

Findings

CVE-2018-14567

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrate

Published Aug 16, 2018 · updated Oct 15, 2026 · xmlsoft libxml2

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 16, 2018 · NIST NVD

    Detected

    libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

  2. Oct 14, 2026 · NIST NVD

    Updated

    libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

  3. Oct 14, 2026 · OSV.dev

    Fix available

    libxml2 fixed in 2.9.10+dfsg-2; libxml2 fixed in 2.9.10+dfsg-2; libxml2 fixed in 2.9.10+dfsg-2

  4. Oct 14, 2026 · OSV.dev

    Fix available

    libxml2 fixed in 2.9.10+dfsg-2

  5. Oct 14, 2026 · OSV.dev

    Updated

    libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

  6. Oct 14, 2026 · OSV.dev

    Updated

    libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

  7. Oct 14, 2026 · OSV.dev

    Updated

    libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

  8. Oct 15, 2026 · OSV.dev

    Updated

    libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

  9. Oct 15, 2026 · OSV.dev

    Updated

    libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

Affected

  • Debian:12 libxml20 → 2.9.10+dfsg-2
  • Debian:13 libxml20 → 2.9.10+dfsg-2
  • Debian:14 libxml20 → 2.9.10+dfsg-2
  • cpe canonical/ubuntu linux14.04
  • cpe canonical/ubuntu linux16.04
  • cpe canonical/ubuntu linux18.04
  • cpe debian/debian linux8.0
  • cpe xmlsoft/libxml22.9.8

Sources

  • CVE.orgCVE-2018-14567

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-14567

    30-day exploitation probability 4.3%

    first.org
  • NIST NVDCVE-2018-14567

    libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

    nvd.nist.gov
  • OSV.devDEBIAN-CVE-2018-14567
    osv.dev

References