Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40304: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. CVE-2022-40303: An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libxml2 | 0:2.9.1-6.amzn2.5.7 |
| Amazon Linux · 2 | libxml2-debuginfo | 0:2.9.1-6.amzn2.5.7 |
| Amazon Linux · 2 | libxml2-devel | 0:2.9.1-6.amzn2.5.7 |
| Amazon Linux · 2 | libxml2-python | 0:2.9.1-6.amzn2.5.7 |
| Amazon Linux · 2 | libxml2-static | 0:2.9.1-6.amzn2.5.7 |
Vulnerabilities 2
-
High 7.8
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, …
-
High 7.5CVE-2022-40303 EPSS 41%
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE pa…