CVE-2023-29469

Public on 2023-04-12
Modified on 2024-02-12
Description

libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-terminated, xmlDictComputeFastKey could produce inconsistent results. This could lead to various logic or memory errors, including double frees.

Severity
Medium
See what this means
CVSS v3 Base Score
5.9
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 1 libxml2 2023-04-27 16:19 ALAS-2023-1743
Amazon Linux 2 - Core libxml2 2023-04-27 18:36 ALAS2-2023-2021
Amazon Linux 2023 libxml2 2023-04-27 20:00 ALAS2023-2023-163

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVSSv3 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H