CVE-2018-14404
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND o
Published Jul 19, 2018 · updated Oct 14, 2026 · canonical ubuntu linux
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Timeline
Detection, updates, and resolution for this record.
Jul 19, 2018 · NIST NVD
Detected
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Oct 14, 2026 · NIST NVD
Updated
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Oct 14, 2026 · OSV.dev
Fix available
libxml2 fixed in 2.9.10+dfsg-2; libxml2 fixed in 2.9.10+dfsg-2; libxml2 fixed in 2.9.10+dfsg-2
Oct 14, 2026 · OSV.dev
Fix available
libxml2 fixed in 2.9.10+dfsg-2
Oct 14, 2026 · OSV.dev
Updated
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Oct 14, 2026 · OSV.dev
Updated
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Affected
- Debian:12 libxml20 → 2.9.10+dfsg-2
- Debian:13 libxml20 → 2.9.10+dfsg-2
- Debian:14 libxml20 → 2.9.10+dfsg-2
- cpe canonical/ubuntu linux12.04
- cpe canonical/ubuntu linux14.04
- cpe canonical/ubuntu linux16.04
- cpe canonical/ubuntu linux18.04
- cpe debian/debian linuxversion unspecified
- cpe xmlsoft/libxml2version unspecified
Sources
- CVE.orgCVE-2018-14404
Official CVE identifier
cve.org - NIST NVDCVE-2018-14404
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2
nvd.nist.gov - OSV.devDEBIAN-CVE-2018-14404osv.dev