ALAS2023-2023-163 — Moderate: libxml2 security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29469: libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-terminated, xmlDictComputeFastKey could produce inconsistent results. This could lead to various logic or memory errors, including double frees. CVE-2023-28484: A NULL pointer dereference exists when parsing (invalid) XML schemas in libxml2 xmlSchemaCheckCOSSTDerivedOK

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2023	libxml2	0:2.10.4-1.amzn2023.0.1
Amazon Linux · 2023	libxml2-debuginfo	0:2.10.4-1.amzn2023.0.1
Amazon Linux · 2023	libxml2-debugsource	0:2.10.4-1.amzn2023.0.1
Amazon Linux · 2023	libxml2-devel	0:2.10.4-1.amzn2023.0.1
Amazon Linux · 2023	libxml2-static	0:2.10.4-1.amzn2023.0.1
Amazon Linux · 2023	python3-libxml2	0:2.10.4-1.amzn2023.0.1
Amazon Linux · 2023	python3-libxml2-debuginfo	0:2.10.4-1.amzn2023.0.1

Vulnerabilities 2

Medium 6.5

CVE-2023-28484

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequentl…

libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Apr 24, 2023
Medium 6.5

CVE-2023-29469

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictCom…

qt5-qtwebengine libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Apr 24, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-28484.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-29469.html

Moderate: libxml2 security update (Amazon Linux 2023)

Summary

Fixed packages 7

Vulnerabilities 2

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequentl…

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictCom…

References