Updated libxml2 packages fix a security vulnerability

2023-09-3022:15:40

Gentoo Foundation

advisories.mageia.org

libxml2 packages

out-of-bounds read

security vulnerability

denial of service

xml file

cve-2023-39615

unix

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.0005 Low

EPSS

Percentile

16.0%

JSON

The updated packages fix a security vulnerability: Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. (CVE-2023-39615).

OSVersionArchitecturePackageVersionFilename
Mageia8noarchlibxml2< 2.9.10-7.8libxml2-2.9.10-7.8.mga8
Mageia9noarchlibxml2< 2.10.4-1.1libxml2-2.10.4-1.1.mga9