PT-2023-5340 · Libxml2+7 · Libxml2+7
Publicado
2023-08-29
·
Atualizado
2025-07-27
·
CVE-2023-39615
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Libxml2 version 2.11.0
Description
The issue is related to an out-of-bounds read via the
xmlSAX2StartElement() function at /libxml2/SAX2.c. This allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. The vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks, and there is a crash even without crafted input.Recommendations
For Libxml2 version 2.11.0, as a temporary workaround, consider disabling the
xmlSAX2StartElement() function until a patch is available. Restrict access to the /libxml2/SAX2.c module to minimize the risk of exploitation. Avoid using crafted XML files that could trigger the out-of-bounds read. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Almalinux
Astra Linux
Centos
Debian
Libxml2
Red Hat
Rocky Linux
Suse