An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document xmlDictComputeFastKey in dict.c can produce non-deterministic values leading to various logic and memory errors such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string and any value is possible (not solely the '\0' value).

🗓️ 25 Apr 2023 07:00:00Reported by MicrosoftType

Libxml2 before 2.10.4 hashes empty dictionary strings non-deterministically in crafted document, causing memory errors.

Reporter	Title	Published	Views	Family All 241
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from systemd, libcap, openssl-libs, libxml2, go-toolset, and prometheus-operator	28 Aug 202308:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	30 Nov 202318:45	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2023-29469 may affect IBM CICS TX Advanced 10.1	8 Jun 202318:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affect IBM Robotic Process Automation for Cloud Pak.	22 Nov 202320:52	–	ibm
IBM Security Bulletins	Security Bulletin: GNOME libxml2 vulnerability affects IBM Safer Payments (CVE-2023-29469)	28 Jul 202313:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	2 Oct 202310:33	–	ibm
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to a denial of service due to libxml2 (CVE-2023-29469 and CVE-2023-28484)	11 Oct 202319:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance - Identity Manager virtual appliance has multiple vulnerabilities	15 Apr 202502:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for December 2023 - Multiple CVEs addressed	8 Jan 202409:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libxml2 library (CVE-2023-28484, CVE-2023-29469) affect Power HMC.	16 Apr 202417:05	–	ibm

Vulners

Node

microsoft cbl2_libxml2_2.10.4-1Range<2.10.4-1

03 Aug 2023 07:00Current

7.1High risk

Vulners AI Score7.1

CVSS 3.16.5

EPSS0.01005

SSVC