Skip to content
OpenAdvisories
Medium ALAS2-2023-2021 2 CVEs

Moderate: libxml2 security update (Amazon Linux 2)

Published Apr 27, 2023 · Updated May 2, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29469: libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-terminated, xmlDictComputeFastKey could produce inconsistent results. This could lead to various logic or memory errors, including double frees. CVE-2023-28484: A NULL pointer dereference exists when parsing (invalid) XML schemas in libxml2 xmlSchemaCheckCOSSTDerivedOK

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libxml2 0:2.9.1-6.amzn2.5.8
Amazon Linux · 2 libxml2-debuginfo 0:2.9.1-6.amzn2.5.8
Amazon Linux · 2 libxml2-devel 0:2.9.1-6.amzn2.5.8
Amazon Linux · 2 libxml2-python 0:2.9.1-6.amzn2.5.8
Amazon Linux · 2 libxml2-static 0:2.9.1-6.amzn2.5.8

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-28484.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-29469.html