A libxml2 security update has been released for Arch Linux.

ASA-202011-15: libxml2: multiple issues

Arch Linux Security Advisory ASA-202011-15
=========================================
Severity: Medium
Date : 2020-11-17
CVE-ID : CVE-2019-20388 CVE-2020-7595 CVE-2020-24977
Package : libxml2
Type : multiple issues
Remote : Yes
Link :   https://security.archlinux.org/AVG-1263

Summary
======
The package libxml2 before version 2.9.10-6 is vulnerable to multiple
issues including denial of service and information disclosure.

Resolution
=========
Upgrade to 2.9.10-6.

# pacman -Syu "libxml2>=2.9.10-6"

The problems have been fixed upstream but no release is available yet.

Workaround
=========
None.

Description
==========
- CVE-2019-20388 (denial of service)

A memory leak was found in the xmlSchemaValidateStream function of
libxml2. Applications that use this library may be vulnerable to memory
not being freed leading to a denial of service.

- CVE-2020-7595 (denial of service)

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an
infinite loop in a certain end-of-file situation.

- CVE-2020-24977 (information disclosure)

GNOME project libxml2