{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2021-3517: fix flaw in the xml entity encoding\n- CVE-2021-3518: fix dangling pointers in entity reference nodes\n- CVE-2022-23308: fix use-after-free of ID and IDREF attributes\n- CVE-2022-40303: fix integer counters overflow when parsing a multi-gigabyte XML\n- CVE-2022-40304: fix double free as a result of an invalid XML entity\n- fix testapi.c to avoid false positive test errors\n- fix a parser and fix a null pointer dereference", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106", "url": "https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2023/clsa-2023_1696537106.json" } ], "tracking": { "current_release_date": "2026-05-05T11:29:03Z", "generator": { "date": "2026-05-05T11:29:03Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2023:1696537106", "initial_release_date": "2023-10-05T16:18:28Z", "revision_history": [ { "date": "2023-10-05T16:18:28Z", "number": "1", "summary": "Initial version" }, { "date": "2026-05-05T11:29:03Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "libxml2: Fix of 5 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "product": { "name": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "product_id": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libxml2-static@2.9.1-6.el7_9.6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "product": { "name": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "product_id": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libxml2@2.9.1-6.el7_9.6.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "product": { "name": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "product_id": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libxml2-devel@2.9.1-6.el7_9.6.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product": { "name": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product_id": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libxml2-static@2.9.1-6.el7_9.6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product": { "name": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product_id": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libxml2@2.9.1-6.el7_9.6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product": { "name": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product_id": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libxml2-devel@2.9.1-6.el7_9.6.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product": { "name": "libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product_id": "libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/libxml2-python@2.9.1-6.el7_9.6.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686" }, "product_reference": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" }, "product_reference": "libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686" }, "product_reference": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" }, "product_reference": "libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" }, "product_reference": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686" }, "product_reference": "libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" }, "product_reference": "libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-23308", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-23308" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/May/33", "url": "http://seclists.org/fulldisclosure/2022/May/33" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/May/34", "url": "http://seclists.org/fulldisclosure/2022/May/34" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/May/35", "url": "http://seclists.org/fulldisclosure/2022/May/35" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/May/36", "url": "http://seclists.org/fulldisclosure/2022/May/36" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/May/37", "url": "http://seclists.org/fulldisclosure/2022/May/37" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/May/38", "url": "http://seclists.org/fulldisclosure/2022/May/38" }, { "category": "external", "summary": "https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e", "url": "https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html", "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202210-03", "url": "https://security.gentoo.org/glsa/202210-03" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20220331-0008/", "url": "https://security.netapp.com/advisory/ntap-20220331-0008/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213253", "url": "https://support.apple.com/kb/HT213253" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213254", "url": "https://support.apple.com/kb/HT213254" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213255", "url": "https://support.apple.com/kb/HT213255" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213256", "url": "https://support.apple.com/kb/HT213256" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213257", "url": "https://support.apple.com/kb/HT213257" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213258", "url": "https://support.apple.com/kb/HT213258" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujul2022.html", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ], "release_date": "2022-02-26T05:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T16:18:28Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106", "product_ids": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-3517", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-3517" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202107-05", "url": "https://security.gentoo.org/glsa/202107-05" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20210625-0002/", "url": "https://security.netapp.com/advisory/ntap-20210625-0002/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20211022-0004/", "url": "https://security.netapp.com/advisory/ntap-20211022-0004/" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuapr2022.html", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujan2022.html", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujul2022.html", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuoct2021.html", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" } ], "release_date": "2021-05-19T14:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T16:18:28Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106", "product_ids": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-3518", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-3518" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2021/Jul/54", "url": "http://seclists.org/fulldisclosure/2021/Jul/54" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2021/Jul/55", "url": "http://seclists.org/fulldisclosure/2021/Jul/55" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2021/Jul/58", "url": "http://seclists.org/fulldisclosure/2021/Jul/58" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2021/Jul/59", "url": "http://seclists.org/fulldisclosure/2021/Jul/59" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=1954242", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954242" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202107-05", "url": "https://security.gentoo.org/glsa/202107-05" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20210625-0002/", "url": "https://security.netapp.com/advisory/ntap-20210625-0002/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT212601", "url": "https://support.apple.com/kb/HT212601" }, { "category": "external", "summary": "https://support.apple.com/kb/HT212602", "url": "https://support.apple.com/kb/HT212602" }, { "category": "external", "summary": "https://support.apple.com/kb/HT212604", "url": "https://support.apple.com/kb/HT212604" }, { "category": "external", "summary": "https://support.apple.com/kb/HT212605", "url": "https://support.apple.com/kb/HT212605" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuapr2022.html", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujul2022.html", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuoct2021.html", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" } ], "release_date": "2021-05-18T12:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T16:18:28Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106", "product_ids": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-40303", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-40303" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/21", "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/24", "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/25", "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/26", "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/27", "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221209-0003/", "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213531", "url": "https://support.apple.com/kb/HT213531" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213533", "url": "https://support.apple.com/kb/HT213533" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213534", "url": "https://support.apple.com/kb/HT213534" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213535", "url": "https://support.apple.com/kb/HT213535" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213536", "url": "https://support.apple.com/kb/HT213536" } ], "release_date": "2022-11-23T00:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T16:18:28Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106", "product_ids": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-40304", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-40304" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/21", "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/24", "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/25", "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/26", "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/27", "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221209-0003/", "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213531", "url": "https://support.apple.com/kb/HT213531" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213533", "url": "https://support.apple.com/kb/HT213533" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213534", "url": "https://support.apple.com/kb/HT213534" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213535", "url": "https://support.apple.com/kb/HT213535" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213536", "url": "https://support.apple.com/kb/HT213536" } ], "release_date": "2022-11-23T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2023-10-05T16:18:28Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106", "product_ids": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2023:1696537106" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-devel-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-python-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.i686", "CentOS-7:libxml2-static-0:2.9.1-6.el7_9.6.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }