Security update for libxml2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3665-1 Final 1 1 2023-09-18T19:51:39Z current 2023-09-18T19:51:39Z 2023-09-18T19:51:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libxml2 This update for libxml2 fixes the following issues: - CVE-2023-29469: Fixed not deterministic hashing of empty dict strings (bsc#1210412). - CVE-2023-28484: Fixed NULL dereference in xmlSchemaFixupComplexType (bsc#1210411). - CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768). - CVE-2016-3709: Fixed cross-site scripting vulnerability in libxml (bsc#1201978). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sles12sp5:latest-2023-3665,Image SLES12-SP5-Azure-BYOS-2023-3665,Image SLES12-SP5-Azure-SAP-BYOS-2023-3665,SUSE-2023-3665,SUSE-SLE-SDK-12-SP5-2023-3665,SUSE-SLE-SERVER-12-SP5-2023-3665 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233665-1/ Link for SUSE-SU-2023:3665-1 https://lists.suse.com/pipermail/sle-security-updates/2023-September/016187.html E-Mail link for SUSE-SU-2023:3665-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1201978 SUSE Bug 1201978 https://bugzilla.suse.com/1210411 SUSE Bug 1210411 https://bugzilla.suse.com/1210412 SUSE Bug 1210412 https://bugzilla.suse.com/1214768 SUSE Bug 1214768 https://www.suse.com/security/cve/CVE-2016-3709/ SUSE CVE CVE-2016-3709 page https://www.suse.com/security/cve/CVE-2023-28484/ SUSE CVE CVE-2023-28484 page https://www.suse.com/security/cve/CVE-2023-29469/ SUSE CVE CVE-2023-29469 page https://www.suse.com/security/cve/CVE-2023-39615/ SUSE CVE CVE-2023-39615 page Container suse/sles12sp5:latest Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-SAP-BYOS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 libxml2-2-2.9.4-46.65.1 libxml2-tools-2.9.4-46.65.1 libxml2-2-32bit-2.9.4-46.65.1 libxml2-2-64bit-2.9.4-46.65.1 libxml2-devel-2.9.4-46.65.1 libxml2-devel-32bit-2.9.4-46.65.1 libxml2-devel-64bit-2.9.4-46.65.1 libxml2-doc-2.9.4-46.65.1 python-libxml2-2.9.4-46.65.1 libxml2-2-2.9.4-46.65.1 as a component of Container suse/sles12sp5:latest libxml2-2-2.9.4-46.65.1 as a component of Image SLES12-SP5-Azure-BYOS libxml2-2-2.9.4-46.65.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libxml2-tools-2.9.4-46.65.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libxml2-2-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server 12 SP5 libxml2-2-32bit-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server 12 SP5 libxml2-doc-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server 12 SP5 libxml2-tools-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server 12 SP5 python-libxml2-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server 12 SP5 libxml2-2-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libxml2-2-32bit-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libxml2-doc-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libxml2-tools-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-libxml2-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libxml2-devel-2.9.4-46.65.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 Possible cross-site scripting vulnerability in libxml after commit 960f0e2. CVE-2016-3709 Container suse/sles12sp5:latest:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-BYOS:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-SAP-BYOS:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-SAP-BYOS:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-2-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-2-32bit-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-doc-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:python-libxml2-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-2-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-2-32bit-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-doc-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-libxml2-2.9.4-46.65.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libxml2-devel-2.9.4-46.65.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233665-1/ https://www.suse.com/security/cve/CVE-2016-3709.html CVE-2016-3709 https://bugzilla.suse.com/1201978 SUSE Bug 1201978 In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. CVE-2023-28484 Container suse/sles12sp5:latest:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-BYOS:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-SAP-BYOS:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-SAP-BYOS:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-2-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-2-32bit-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-doc-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:python-libxml2-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-2-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-2-32bit-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-doc-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-libxml2-2.9.4-46.65.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libxml2-devel-2.9.4-46.65.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233665-1/ https://www.suse.com/security/cve/CVE-2023-28484.html CVE-2023-28484 https://bugzilla.suse.com/1210411 SUSE Bug 1210411 An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value). CVE-2023-29469 Container suse/sles12sp5:latest:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-BYOS:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-SAP-BYOS:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-SAP-BYOS:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-2-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-2-32bit-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-doc-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:python-libxml2-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-2-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-2-32bit-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-doc-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-libxml2-2.9.4-46.65.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libxml2-devel-2.9.4-46.65.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233665-1/ https://www.suse.com/security/cve/CVE-2023-29469.html CVE-2023-29469 https://bugzilla.suse.com/1210412 SUSE Bug 1210412 ** DISPUTED ** Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. CVE-2023-39615 Container suse/sles12sp5:latest:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-BYOS:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-SAP-BYOS:libxml2-2-2.9.4-46.65.1 Image SLES12-SP5-Azure-SAP-BYOS:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-2-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-2-32bit-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-doc-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server 12 SP5:python-libxml2-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-2-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-2-32bit-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-doc-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libxml2-tools-2.9.4-46.65.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-libxml2-2.9.4-46.65.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libxml2-devel-2.9.4-46.65.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233665-1/ https://www.suse.com/security/cve/CVE-2023-39615.html CVE-2023-39615 https://bugzilla.suse.com/1214768 SUSE Bug 1214768