Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-40304: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. CVE-2022-40303: An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | xmlsec1 | 0:1.2.33-3.amzn2023.0.2 |
| Amazon Linux · 2023 | xmlsec1-debuginfo | 0:1.2.33-3.amzn2023.0.2 |
| Amazon Linux · 2023 | xmlsec1-debugsource | 0:1.2.33-3.amzn2023.0.2 |
| Amazon Linux · 2023 | xmlsec1-devel | 0:1.2.33-3.amzn2023.0.2 |
| Amazon Linux · 2023 | xmlsec1-openssl | 0:1.2.33-3.amzn2023.0.2 |
| Amazon Linux · 2023 | xmlsec1-openssl-debuginfo | 0:1.2.33-3.amzn2023.0.2 |
| Amazon Linux · 2023 | xmlsec1-openssl-devel | 0:1.2.33-3.amzn2023.0.2 |
Vulnerabilities 2
-
High 7.8
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, …
-
High 7.5CVE-2022-40303 EPSS 41%
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE pa…