CVE-2023-29469

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.(CVE-2023-28484)

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).(CVE-2023-29469)

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: NULL dereference in xmlSchemaFixupComplexType (CVE-2023-28484)

• libxml2: Hashing of empty dict strings isn't deterministic (CVE-2023-29469)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: NULL dereference in xmlSchemaFixupComplexType (CVE-2023-28484)
• libxml2: Hashing of empty dict strings isn't deterministic (CVE-2023-29469)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: NULL dereference in xmlSchemaFixupComplexType (CVE-2023-28484)
• libxml2: Hashing of empty dict strings isn't deterministic (CVE-2023-29469)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: Null dereference
  • debian/patches/CVE-2023-28484.patch: Fix null-pointer-deref in xmlSchemaFixupComplexType
  • CVE-2023-28484
• SECURITY UPDATE: Fix a null pointer dereference
  • debian/patches/fix-null-ptr-deref.patch: use XML_SCHEMAS_ANYTYPE instead of a null pointer
  • CVE-2023-28484
• SECURITY UPDATE: Logic or memory errors
  • debian/patches/CVE-2023-29469.patch: check whether namelen is less than or equal to zero
  • CVE-2023-29469
• Add test suite
  • debian/patches/enable-building-tests.patch: enable building tests
  • debian/patches/fix-testapi.patch: fix buffer overflow in tests

• CVE-2023-29469: dict.c: fix non-deterministic hashing of empty dict strings
• CVE-2023-28484: fix NULL pointer dereferences in xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK

• CVE-2023-29469: dict.c: fix non-deterministic hashing of empty dict strings
• CVE-2023-28484: fix NULL pointer dereferences in xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK

• CVE-2023-29469: guard xmlDictComputeFastKey against namelen <= 0 to prevent out-of-bounds read when hashing zero-length or negative-length keys
• CVE-2023-45322: fix use-after-free in xmlNodeDumpOutputInternal triggered by malformed XML when default error handler interacts with freed memory
• CVE-2024-34459: bound the backwards trim in xmlHTMLPrintFileContext so it cannot overread the buffer when scanning for newline / carriage-return
• CVE-2025-9714: keep and restore XPath context depth across recursive xmlXPathRunEval invocations (EXSLT dyn:map / dyn:evaluate) to avoid stack overflow when the recursion limit was being reset prematurely

• CVE-2023-29469: guard xmlDictComputeFastKey against namelen <= 0 to prevent out-of-bounds read when hashing zero-length or negative-length keys
• CVE-2023-45322: fix use-after-free in xmlNodeDumpOutputInternal triggered by malformed XML when default error handler interacts with freed memory
• CVE-2024-34459: bound the backwards trim in xmlHTMLPrintFileContext so it cannot overread the buffer when scanning for newline / carriage-return
• CVE-2025-9714: keep and restore XPath context depth across recursive xmlXPathRunEval invocations (EXSLT dyn:map / dyn:evaluate) to avoid stack overflow when the recursion limit was being reset prematurely

• CVE-2023-29469: guard xmlDictComputeFastKey against namelen <= 0 to prevent out-of-bounds read when hashing zero-length or negative-length keys
• CVE-2023-45322: fix use-after-free in xmlNodeDumpOutputInternal triggered by malformed XML when default error handler interacts with freed memory
• CVE-2024-34459: bound the backwards trim in xmlHTMLPrintFileContext so it cannot overread the buffer when scanning for newline / carriage-return
• CVE-2025-9714: keep and restore XPath context depth across recursive xmlXPathRunEval invocations (EXSLT dyn:map / dyn:evaluate) to avoid stack overflow when the recursion limit was being reset prematurely

NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered. (CVE-2022-2309) NULL dereference in xmlSchemaFixupComplexType. (CVE-2023-28484) Hashing of empty dict strings isn't deterministic. (CVE-2023-29469)

These are all security issues fixed in the libxml2-2-2.10.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libQt5Pdf5-5.15.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.15.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.

This update for libxml2 fixes the following issues:

• CVE-2023-29469: Fixed inconsistent result when hashing empty strings (bsc#1210412).

• CVE-2023-28484: Fixed NULL pointer dereference in xmlSchemaFixupComplexType (bsc#1210411).

• CVE-2022-29824: Fixed integer overflow leading to out-of-bounds write in buf.c (bsc#1199132).

  The following non-security bugs were fixed:

• Added W3C conformance tests to the testsuite (bsc#1204585).

• Fixed NULL pointer dereference when parsing invalid data (glgo#libxml2!15) (bsc#1065270) .

This update for libxml2 fixes the following issues:

• CVE-2023-29469: Fixed inconsistent result when hashing empty strings (bsc#1210412).
• CVE-2023-28484: Fixed NULL pointer dereference in xmlSchemaFixupComplexType (bsc#1210411).

The following non-security bug was fixed:

• Remove unneeded dependency (bsc#1209918).

This update for libxml2 fixes the following issues:

• CVE-2023-29469: Fixed inconsistent result when hashing empty strings (bsc#1210412).
• CVE-2023-28484: Fixed NULL pointer dereference in xmlSchemaFixupComplexType (bsc#1210411).

This update for libxml2 fixes the following issues:

• CVE-2023-29469: Fixed not deterministic hashing of empty dict strings (bsc#1210412).
• CVE-2023-28484: Fixed NULL dereference in xmlSchemaFixupComplexType (bsc#1210411).
• CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768).
• CVE-2016-3709: Fixed cross-site scripting vulnerability in libxml (bsc#1201978).

It was discovered that lixml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2023-28484)

It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash. (CVE-2023-29469)