Red Hat Security Advisory

RHSA-2024:0413

libxml2 security update

Released 2024-01-25 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.8.6) libxml2-devel-2.9.7-13.el8_6.4
Red Hat Enterprise Linux BaseOS EUS (v.8.6) libxml2-2.9.7-13.el8_6.4, python3-libxml2-2.9.7-13.el8_6.4

TI-2022-19140 CVE-2022-40303 · GHSA-94m8-rgr8-rg5g

HIGH 67

An issue was discovered in libxml2 before 2.10.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.41365 Published 2022-11-22 Partial fix CWE-190

TI-2023-20700 CVE-2023-39615 · GHSA-9fj4-8443-vg2m

MEDIUM 62

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01079 Published 2023-08-29 Partial fix CWE-119

TI-2022-19141 CVE-2022-40304 · GHSA-g848-pppp-vg6f

MEDIUM 43

An issue was discovered in libxml2 before 2.10.3.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.05812 Published 2022-11-23 Partial fix CWE-415

TI-2023-13846 CVE-2023-29469 · GHSA-7jv7-hr35-fwjr

LOW 31

An issue was discovered in libxml2 before 2.10.4.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01309 Published 2023-04-24 Partial fix CWE-415

TI-2023-13024 CVE-2023-28484 · GHSA-7cv2-wjgm-j7rm

LOW 31

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01245 Published 2023-04-24 Partial fix CWE-476