CVE-2023-29469

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-24 · updated 2026-10-14
Weakness: CWE-415

Description

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

Affected products

Debian Linux: 10.0
xmlsoft libxml2: before 2.10.4 — fixed in 2.10.4

How to fix

Upgrade to a fixed version: xmlsoft libxml2 2.10.4. Check the vendor advisory for mitigations.

References

https://gitlab.gnome.org/GNOME/libxml2/-/issues/510
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4
https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html
https://security.netapp.com/advisory/ntap-20230601-0006/
https://gitlab.gnome.org/GNOME/libxml2/-/issues/510
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4
https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html
https://security.netapp.com/advisory/ntap-20230601-0006/
https://cert-portal.siemens.com/productcert/html/ssa-341067.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://cert-portal.siemens.com/productcert/html/ssa-556635.html
https://cert-portal.siemens.com/productcert/html/ssa-625862.html

Get alerted when CVE-2023-29469 or the next vulnerability affects your stack