CVE-2023-29469

Katalog CVE

CVSS 6.5 · Medium EPSS 1,0%

Kerentanan Double Free pada xmlsoft libxml2, debian linux. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

Rincian

Terbit di NVD

24 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-415: Double Free

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.gnome.org/GNOME/libxml2/-/issues/510 issue tracking · advisory vendor
• https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html mailing list · advisory pihak ketiga
• https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4 release notes
• https://security.netapp.com/advisory/ntap-20230601-0006/