CVE-2019-19956: canonical ubuntu_linux
Modified
AliasesALPINE-CVE-2019-19956MGASA-2020-0020MGASA-2020-0271SUSE-SU-2020:1532-1SUSE-SU-2020:1532-2UBUNTU-CVE-2019-19956DEBIAN-CVE-2019-19956DLA-2048-1openSUSE-SU-2020:0781-1
Published 24-12-2019Last modified 14-10-2026
Vulnerability summary
CVE-2019-19956 is a high (CVSS 7.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 5.63% chance of exploitation in the next 30 days, higher than 92.9% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 6% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
5.63%
0%100%
Low · +0.07 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 10 · Related 6Timeline
- 24-12-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
5.63%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 5.56% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
- CWE-772Missing Release of Resource after Effective LifetimeThe product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp6 products
- active_iq_unified_managerna
- clustered_data_ontapna
- clustered_data_ontap_antivirus_connectorna
- manageability_software_development_kitna
- ontap_select_deploy_administration_utilityna
Suse6 products
- libxml2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.9.7-3.22.1
- libxml2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 2.9.7-3.22.1
- python-libxml2-python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.9.7-3.22.1
- python-libxml2-python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 2.9.7-3.22.1
- python-libxml2-python&distro=SUSE Linux Enterprise Module for Python 2 15 SP1< 2.9.7-3.22.1
Debian2 products
- libxml2< 2.9.1+dfsg1-5+deb8u8 | < 2.9.10+dfsg-2
- debian_linuxEOL8.0 | 9.0
Opensuse2 products
- libxml2&distro=openSUSE Leap 15.1< 2.9.7-lp151.5.12.1
- python-libxml2-python&distro=openSUSE Leap 15.1< 2.9.7-lp151.5.12.1
Alpine1 product
- libxml2< 2.9.9-r3 | < 2.9.8-r2 | < 2.9.9-r2
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.10
Fedoraproject1 product
- fedoraEOL30 | 32
Mageia1 product
- libxml2< 2.9.9-2.1.mga7 | < 2.9.9-2.4.mga7
Oracle1 product
- real_user_experience_insight13.3.1.0
Siemens1 product
Ubuntu1 product
- libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm1 | < 2.9.3+dfsg1-1ubuntu0.7 | < 2.9.4+dfsg1-6.1ubuntu1.3
Xmlsoft1 product
- libxml2< 2.9.10
12 vendors · 24 products
References
30 links
lists.debian.org/debian-lts-announce/2019/12/msg00032.htmlMailing ListX Refsource MLISTREPORTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.htmlVendor AdvisoryX Refsource SUSEBroken Link
- lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.htmlVendor AdvisoryX Refsource SUSEBroken Link
- gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549X Refsource MISCPatchThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/09/msg00009.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 30 references
- us-cert.cisa.gov/ics/advisories/icsa-21-103-08X Refsource CONFIRMThird Party AdvisoryUS Government Resource
- lists.opensuse.org/archives/…Advisory