Skip to content
OpenAdvisories
Medium ALAS2023-2023-343 1 CVE

Moderate: libxml2 security update (Amazon Linux 2023)

Published Sep 14, 2023 · Updated Sep 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39615: Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 libxml2 0:2.10.4-1.amzn2023.0.4
Amazon Linux · 2023 libxml2-debuginfo 0:2.10.4-1.amzn2023.0.4
Amazon Linux · 2023 libxml2-debugsource 0:2.10.4-1.amzn2023.0.4
Amazon Linux · 2023 libxml2-devel 0:2.10.4-1.amzn2023.0.4
Amazon Linux · 2023 libxml2-static 0:2.10.4-1.amzn2023.0.4
Amazon Linux · 2023 python3-libxml2 0:2.10.4-1.amzn2023.0.4
Amazon Linux · 2023 python3-libxml2-debuginfo 0:2.10.4-1.amzn2023.0.4

Vulnerabilities 1

  • Unscored —
    CVE-2023-39615

    Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libx…

    libxml2 Debian

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-39615.html