Skip to content
OpenAdvisories
Medium ALAS2023-2023-097 2 CVEs

Moderate: xmlsec1 security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-40304: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. CVE-2022-40303: An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 xmlsec1 0:1.2.33-3.amzn2023.0.2
Amazon Linux · 2023 xmlsec1-debuginfo 0:1.2.33-3.amzn2023.0.2
Amazon Linux · 2023 xmlsec1-debugsource 0:1.2.33-3.amzn2023.0.2
Amazon Linux · 2023 xmlsec1-devel 0:1.2.33-3.amzn2023.0.2
Amazon Linux · 2023 xmlsec1-openssl 0:1.2.33-3.amzn2023.0.2
Amazon Linux · 2023 xmlsec1-openssl-debuginfo 0:1.2.33-3.amzn2023.0.2
Amazon Linux · 2023 xmlsec1-openssl-devel 0:1.2.33-3.amzn2023.0.2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-40303.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-40304.html