Skip to content
OpenAdvisories
Medium ALAS2-2023-2249 1 CVE

Moderate: libxml2 security update (Amazon Linux 2)

Published Sep 13, 2023 · Updated Sep 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-39615: Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libxml2 0:2.9.1-6.amzn2.5.11
Amazon Linux · 2 libxml2-debuginfo 0:2.9.1-6.amzn2.5.11
Amazon Linux · 2 libxml2-devel 0:2.9.1-6.amzn2.5.11
Amazon Linux · 2 libxml2-python 0:2.9.1-6.amzn2.5.11
Amazon Linux · 2 libxml2-static 0:2.9.1-6.amzn2.5.11

Vulnerabilities 1

  • Unscored —
    CVE-2023-39615

    Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libx…

    libxml2 Debian

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-39615.html