Moderate: libxml2 security update

Related Vulnerabilities: CVE-2022-40303   CVE-2022-40304   CVE-2023-28484   CVE-2023-29469   CVE-2023-39615  

Synopsis

Moderate: libxml2 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libxml2 is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

  • libxml2: integer overflows with XML_PARSE_HUGE (CVE-2022-40303)
  • libxml2: dict corruption caused by entity reference cycles (CVE-2022-40304)
  • libxml2: NULL dereference in xmlSchemaFixupComplexType (CVE-2023-28484)
  • libxml2: Hashing of empty dict strings isn't deterministic (CVE-2023-29469)
  • libxml2: crafted xml can cause global buffer overflow (CVE-2023-39615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The desktop must be restarted (log out, then log back in) for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.6 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

  • BZ - 2136266 - CVE-2022-40303 libxml2: integer overflows with XML_PARSE_HUGE
  • BZ - 2136288 - CVE-2022-40304 libxml2: dict corruption caused by entity reference cycles
  • BZ - 2185984 - CVE-2023-29469 libxml2: Hashing of empty dict strings isn't deterministic
  • BZ - 2185994 - CVE-2023-28484 libxml2: NULL dereference in xmlSchemaFixupComplexType
  • BZ - 2235864 - CVE-2023-39615 libxml2: crafted xml can cause global buffer overflow