CVEvulnerability
CVE-2023-29469
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-04-24
- Last modified
- 2026-10-14
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-415
Description
An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).
Affected configurations
• xmlsoft libxml2 (< 2.10.4)
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-415 Double Free weakness
References
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/510 Issue Tracking, Vendor Advisory
- https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4 Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230601-0006/ security.netapp.com
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/510 Issue Tracking, Vendor Advisory
- https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4 Release Notes
- https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230601-0006/ security.netapp.com
- https://cert-portal.siemens.com/productcert/html/ssa-341067.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-556635.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-625862.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-769027.html cert-portal.siemens.com