CVE-2023-29469

MediumCVSS 6.5/10Last modified Oct 14, 2026

Description

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-415

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

https://gitlab.gnome.org/GNOME/libxml2/-/issues/510Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4Release Notes
https://lists.debian.org/debian-lts-announce/2023/04/msg00031.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230601-0006/
https://gitlab.gnome.org/GNOME/libxml2/-/issues/510Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4Release Notes
https://lists.debian.org/debian-lts-announce/2023/04/msg00031.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230601-0006/
https://cert-portal.siemens.com/productcert/html/ssa-341067.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://cert-portal.siemens.com/productcert/html/ssa-556635.html
https://cert-portal.siemens.com/productcert/html/ssa-625862.html
https://cert-portal.siemens.com/productcert/html/ssa-769027.html

Timeline

Published: Apr 24, 2023
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-29474.8Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-294715.5Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain clear CVE-2023-294739.8webservice in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attac CVE-2023-294749.8inventory in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attack CVE-2023-294759.8inventory in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attack CVE-2023-294769.1In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. T CVE-2023-294789.8BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on th CVE-2023-294795.3Ribose RNP before 0.16.3 may hang when the input is malformed.CVE-2023-29486.1Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-294807.5Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.CVE-2023-294837.0eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending CVE-2023-294846.5In Terminalfour before 8.3.16, misconfigured LDAP users are able to login with an invalid password.