CVE-2023-28484CWE-476

CVE-2023-28484

Medium · published April 25, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
69.1
In the wild
Unconfirmed
What it is

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01245 · 69.1th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2023-04-25T01:15Z
Affected products (2)
ProductVersionsFixed in
xmlsoft/libxml2< 2.10.42.10.4
debian/debian_linuxall versions—
References (15)
https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-556635.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-625862.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-769027.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-341067.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://security.netapp.com/advisory/ntap-20230601-0006/ · [email protected]https://security.netapp.com/advisory/ntap-20240201-0005/ · [email protected]https://gitlab.gnome.org/GNOME/libxml2/-/issues/491 · af854a3a-2127-422b-91ae-364da2661108https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20230601-0006/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240201-0005/ · af854a3a-2127-422b-91ae-364da2661108https://gitlab.gnome.org/GNOME/libxml2/-/issues/491 · [email protected]https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4 · [email protected]https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html · [email protected]
EPSS history
Timeline
  • 24 APR 00:00Z
    In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault
    cvelistv5