The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Debian_linux | Debian | 7.0 (including) | 7.0 (including) |
| Debian_linux | Debian | 8.0 (including) | 8.0 (including) |
| Red Hat Ansible Tower 3.5 for RHEL 7 | RedHat | ansible-tower-35/ansible-tower:3.5.6-1 | * |
| Red Hat Ansible Tower 3.6 for RHEL 7 | RedHat | ansible-tower-36/ansible-tower:3.6.4-1 | * |
| Red Hat Enterprise Linux 7 | RedHat | libxml2-0:2.9.1-6.el7.4 | * |
| Red Hat JBoss Web Server 3.0 | RedHat | libxml2 | * |
| Libxml2 | Ubuntu | devel | * |
| Libxml2 | Ubuntu | trusty | * |