CVE-2019-19956 Denial of service in n/a
A memory leak in libxml2 allows attackers to cause denial of service by exhausting system memory through crafted XML input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19956?
CVE-2019-19956 is a high-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 24 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
Which versions are affected by CVE-2019-19956?
It affects 12 products.
Linux distribution packages (8)
libxml2 SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 2.9.7-3.22.1 |
python-libxml2-python SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 2.9.7-3.22.1 |
libxml2 SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 2.9.7-3.22.1 |
python-libxml2-python SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 2.9.7-3.22.1 |
python-libxml2-python SUSE:Linux Enterprise Module for Python 2 15 SP1 | All versions | 2.9.7-3.22.1 |
python-libxml2-python SUSE:Linux Enterprise Module for Python 2 15 SP2 | All versions | 2.9.7-3.22.1 |
libxml2 openSUSE:Leap 15.1 | All versions | 2.9.7-lp151.5.12.1 |
python-libxml2-python openSUSE:Leap 15.1 | All versions | 2.9.7-lp151.5.12.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Netapp Active Iq Unified Manager, Netapp Clustered Data Ontap, Netapp Clustered Data Ontap Antivirus Connector and 6 more.
How do I fix CVE-2019-19956?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-19956 being exploited?
There is no known exploitation of CVE-2019-19956 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2019-19956, DEBIAN-CVE-2019-19956, DLA-2048-1, ECHO-36f8-7dd5-7a33, GHSA-5cvc-j2xm-h554, JLSEC-2025-66 and 6 more.