Log in Start free

Vulnerability · Published Apr 24, 2023 · Assigned by mitre

CVE-2023-28484

Medium 6.5

In plain English

A medium-severity null pointer dereference in the libxml2 package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.2%top 30.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libxml22.9.7-16.el8_8.1ALSA-2023:4529
AlmaLinux:9libxml22.9.13-3.el9_2.1ALSA-2023:4349
AlmaLinux:8libxml2-devel2.9.7-16.el8_8.1ALSA-2023:4529
AlmaLinux:9libxml2-devel2.9.13-3.el9_2.1ALSA-2023:4349
AlmaLinux:8python3-libxml22.9.7-16.el8_8.1ALSA-2023:4529
AlmaLinux:9python3-libxml22.9.13-3.el9_2.1ALSA-2023:4349
Alpine:v3.20libxml22.10.4-r0ALPINE-CVE-2023-28484
Alpine:v3.21libxml22.10.4-r0ALPINE-CVE-2023-28484
Alpine:v3.22libxml22.10.4-r0ALPINE-CVE-2023-28484
Alpine:v3.23libxml22.10.4-r0ALPINE-CVE-2023-28484
Alpine:v3.24libxml22.10.4-r0ALPINE-CVE-2023-28484
Debian:12libxml22.9.14+dfsg-1.2DEBIAN-CVE-2023-28484
Debian:13libxml22.9.14+dfsg-1.2DEBIAN-CVE-2023-28484
Debian:14libxml22.9.14+dfsg-1.2DEBIAN-CVE-2023-28484
Rocky Linux:8libxml20:2.9.7-16.el8_8.1RLSA-2023:4529
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.3UBUNTU-CVE-2023-28484
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.3USN-6028-1

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References