A flaw was found in libxml2 2.9.8. The xz_decomp function in xzlib.c, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.
Reference:
https://bugzilla.gnome.org/show_bug.cgi?id=794914
Created mingw-libxml2 tracking bugs for this issue:
Affects: fedora-all [bug 1565320]
Created libxml2 tracking bugs for this issue:
Affects: fedora-all [bug 1565321]
Created mingw-libxml2 tracking bugs for this issue:
Affects: epel-7 [bug 1565319]