Skip to content
OpenAdvisories
Medium ALAS2-2023-1996 2 CVEs

Moderate: libxml2 security update (Amazon Linux 2)

Published Mar 17, 2023 · Updated Mar 21, 2023

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40304: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. CVE-2022-40303: An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libxml2 0:2.9.1-6.amzn2.5.7
Amazon Linux · 2 libxml2-debuginfo 0:2.9.1-6.amzn2.5.7
Amazon Linux · 2 libxml2-devel 0:2.9.1-6.amzn2.5.7
Amazon Linux · 2 libxml2-python 0:2.9.1-6.amzn2.5.7
Amazon Linux · 2 libxml2-static 0:2.9.1-6.amzn2.5.7

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-40303.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-40304.html