--- id: CVE-2020-7595 title: >- xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. summary: >- xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-835 - CWE-835 vendor: xmlsoft product: libxml2 affected: - libxml2 = 2.9.10 - fedora = 30 - fedora = 31 - fedora = 32 - ubuntu_linux = 12.04 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.10 - debian_linux = 9.0 - sinema_remote_connect_server < 3.0 - clustered_data_ontap - smi-s_provider - snapdrive - steelstore_cloud_integrated_storage - symantec_netbackup - h300s_firmware - h500s_firmware - h700s_firmware - h300e_firmware - h500e_firmware - h700e_firmware - h410s_firmware - h410c_firmware - real_user_experience_insight = 13.3.1.0 - >- communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0 - enterprise_manager_base_platform = 13.4.0.0 - enterprise_manager_base_platform = 13.5.0.0 - enterprise_manager_ops_center = 12.4.0.0 - mysql_workbench <= 8.0.26 - peoplesoft_enterprise_peopletools = 8.58 - real_user_experience_insight = 13.4.1.0 - real_user_experience_insight = 13.5.1.0 patched: - sinema_remote_connect_server 3.0 published: '2020-01-21' updated: '2026-10-14' sourceUpdated: '2026-10-14T09:17:19.327' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-7595' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html' label: cve@mitre.org - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf' label: cve@mitre.org - url: 'https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/ label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202010-04' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200702-0005/' label: cve@mitre.org - url: 'https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4274-1/' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202010-04' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200702-0005/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4274-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-292794.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.07836 epssPercentile: 0.94568 ingestedAt: '2026-10-14T09:24:26.051Z' --- ## Overview xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. ## Affected - `libxml2 = 2.9.10` - `fedora = 30` - `fedora = 31` - `fedora = 32` - `ubuntu_linux = 12.04` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.10` - `debian_linux = 9.0` - `sinema_remote_connect_server < 3.0` - `clustered_data_ontap` - `smi-s_provider` - `snapdrive` - `steelstore_cloud_integrated_storage` - `symantec_netbackup` - `h300s_firmware` - `h500s_firmware` - `h700s_firmware` - `h300e_firmware` - `h500e_firmware` - `h700e_firmware` - `h410s_firmware` - `h410c_firmware` - `real_user_experience_insight = 13.3.1.0` - `communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0` - `enterprise_manager_base_platform = 13.4.0.0` - `enterprise_manager_base_platform = 13.5.0.0` - `enterprise_manager_ops_center = 12.4.0.0` - `mysql_workbench <= 8.0.26` - `peoplesoft_enterprise_peopletools = 8.58` - `real_user_experience_insight = 13.4.1.0` - `real_user_experience_insight = 13.5.1.0` ## Remediation Upgrade past the affected range: - `sinema_remote_connect_server 3.0`