CVE-2023-45322

The CVE-2023-45322 issue affects libxml2 up to version 2.11.5, with a use-after-free in xmlUnlinkNode (tree.c) that requires a failing memory allocation to trigger. Affected products include libxml2 libraries used in multiple distributions (Debian, Amazon Linux, Gentoo, CBLMariner, Astra Linux, e...

CVE-2023-28484

CVE-2023-28484 affects libxml2 up to version 2.10.3, where parsing certain invalid XSD schemas can trigger a NULL pointer dereference in xmlSchemaFixupComplexType (xmlschemas.c), potentially causing a segfault. The issue is addressed by libxml2 2.10.4 (release notes linked in connected docs). Rem...

CVE-2023-29469

libxml2 before 2.10.4 is affected by CVE-2023-29469 and CVE-2023-28484. The issue stems from hashing empty dict strings in crafted XML, leading to non-deterministic dict keys and memory errors such as double frees. Affected products include libxml2 implementations used in various stacks; upgrade ...

CVE-2023-39615

CVE-2023-39615 : Libxml2 (version 2.11.0) contains an out-of-bounds read in xmlSAX2StartElement() (/libxml2/SAX2.c) that can cause a Denial of Service when parsing a crafted XML. The vendor notes that Libxml2 does not support the legacy SAX1 interface with custom callbacks; there is a crash even ...