Medium: libxml2

Issue Overview:

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a ‘%’ character in a DTD name. (CVE-2017-16931)

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e. (CVE-2020-24977)

There’s a flaw in libxml2’s xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability. (CVE-2021-3516)

There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application. (CVE-2021-3517)

There’s a flaw in libxml2. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. (CVE-2021-3518)

A NULL pointer dereference flaw was found in libxml2, where it did not propagate errors while parsing XML mixed content. This flaw causes the application to crash if an untrusted XML document is parsed in recovery mode and post validated. The highest threat from this vulnerability is to system availability. (CVE-2021-3537)

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service. (CVE-2021-3541)

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. (CVE-2022-23308)

A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the xmlBuffer types. A substantial input causes values to calculate buffer sizes to overflow, resulting in an out-of-bounds write. (CVE-2022-29824)

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. (CVE-2022-40304)

A NULL pointer dereference exists when parsing (invalid) XML schemas in libxml2 xmlSchemaCheckCOSSTDerivedOK (CVE-2023-28484)

libxml2 Hashing of empty dict strings isn’t deterministic. When hashing empty strings which aren’t null-terminated, xmlDictComputeFastKey could produce inconsistent results. This could lead to various logic or memory errors, including double frees. (CVE-2023-29469)

Affected Packages:

libxml2

Issue Correction:
Run yum update libxml2 to update your system.

New Packages:

i686:  
    libxml2-python27-2.9.1-6.6.42.amzn1.i686  
    libxml2-debuginfo-2.9.1-6.6.42.amzn1.i686  
    libxml2-2.9.1-6.6.42.amzn1.i686  
    libxml2-devel-2.9.1-6.6.42.amzn1.i686  
    libxml2-python26-2.9.1-6.6.42.amzn1.i686  
    libxml2-static-2.9.1-6.6.42.amzn1.i686  
  
src:  
    libxml2-2.9.1-6.6.42.amzn1.src  
  
x86_64:  
    libxml2-2.9.1-6.6.42.amzn1.x86_64  
    libxml2-debuginfo-2.9.1-6.6.42.amzn1.x86_64  
    libxml2-static-2.9.1-6.6.42.amzn1.x86_64  
    libxml2-devel-2.9.1-6.6.42.amzn1.x86_64  
    libxml2-python26-2.9.1-6.6.42.amzn1.x86_64  
    libxml2-python27-2.9.1-6.6.42.amzn1.x86_64  

Additional References

Red Hat: CVE-2017-16931, CVE-2020-24977, CVE-2021-3516, CVE-2021-3517, CVE-2021-3518, CVE-2021-3537, CVE-2021-3541, CVE-2022-23308, CVE-2022-29824, CVE-2022-40303, CVE-2022-40304, CVE-2023-28484, CVE-2023-29469

Mitre: CVE-2017-16931, CVE-2020-24977, CVE-2021-3516, CVE-2021-3517, CVE-2021-3518, CVE-2021-3537, CVE-2021-3541, CVE-2022-23308, CVE-2022-29824, CVE-2022-40303, CVE-2022-40304, CVE-2023-28484, CVE-2023-29469