CVE-2023-29469

2023-04-1200:00:00

ubuntu.com

cve-2023-29469; libxml2; xml document

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

46.5%

JSON

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict
strings in a crafted XML document, xmlDictComputeFastKey in dict.c can
produce non-deterministic values, leading to various logic and memory
errors, such as a double free. This behavior occurs because there is an
attempt to use the first byte of an empty string, and any value is possible
(not solely the ‘\0’ value).

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=2185984>

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlibxml2< 2.9.4+dfsg1-6.1ubuntu1.9UNKNOWN
ubuntu20.04noarchlibxml2< 2.9.10+dfsg-5ubuntu0.20.04.6UNKNOWN
ubuntu22.04noarchlibxml2< 2.9.13+dfsg-1ubuntu0.3UNKNOWN
ubuntu22.10noarchlibxml2< 2.9.14+dfsg-1ubuntu0.2UNKNOWN
ubuntu23.04noarchlibxml2< 2.9.14+dfsg-1.1ubuntu0.1UNKNOWN
ubuntu14.04noarchlibxml2< 2.9.1+dfsg1-3ubuntu4.13+esm5UNKNOWN
ubuntu16.04noarchlibxml2< 2.9.3+dfsg1-1ubuntu0.7+esm5UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	libxml2	< 2.9.4+dfsg1-6.1ubuntu1.9	UNKNOWN
ubuntu	20.04	noarch	libxml2	< 2.9.10+dfsg-5ubuntu0.20.04.6	UNKNOWN
ubuntu	22.04	noarch	libxml2	< 2.9.13+dfsg-1ubuntu0.3	UNKNOWN
ubuntu	22.10	noarch	libxml2	< 2.9.14+dfsg-1ubuntu0.2	UNKNOWN
ubuntu	23.04	noarch	libxml2	< 2.9.14+dfsg-1.1ubuntu0.1	UNKNOWN
ubuntu	14.04	noarch	libxml2	< 2.9.1+dfsg1-3ubuntu4.13+esm5	UNKNOWN
ubuntu	16.04	noarch	libxml2	< 2.9.3+dfsg1-1ubuntu0.7+esm5	UNKNOWN