Security update for libxml2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3699-1 Final 1 1 2023-09-20T09:02:59Z current 2023-09-20T09:02:59Z 2023-09-20T09:02:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libxml2 This update for libxml2 fixes the following issues: - CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/bci-init:15.4-2023-3699,Container bci/python:3-2023-3699,Container suse/manager/4.3/proxy-httpd:latest-2023-3699,Container suse/manager/4.3/proxy-salt-broker:latest-2023-3699,Container suse/manager/4.3/proxy-squid:latest-2023-3699,Container suse/manager/4.3/proxy-ssh:latest-2023-3699,Container suse/manager/4.3/proxy-tftpd:latest-2023-3699,Container suse/pcp:5-2023-3699,Container suse/postgres:14-2023-3699,Container suse/sle-micro-rancher/5.3:latest-2023-3699,Container suse/sle-micro-rancher/5.4:latest-2023-3699,Container suse/sle-micro/5.3/toolbox:latest-2023-3699,Container suse/sle-micro/5.4/toolbox:latest-2023-3699,Container suse/sle15:15.4-2023-3699,Image SLES15-SP4-CHOST-BYOS-2023-3699,Image SLES15-SP4-CHOST-BYOS-Aliyun-2023-3699,Image SLES15-SP4-CHOST-BYOS-Azure-2023-3699,Image SLES15-SP4-CHOST-BYOS-EC2-2023-3699,Image SLES15-SP4-CHOST-BYOS-GCE-2023-3699,Image SLES15-SP4-CHOST-BYOS-SAP-CCloud-2023-3699,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-2023-3699,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure-2023-3699,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2-2023-3699,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE-2023-3699,Image SLES15-SP4-Manager-Server-4-3-BYOS-2023-3699,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2023-3699,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2023-3699,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2023-3699,Image SLES15-SP4-Micro-5-3-2023-3699,Image SLES15-SP4-Micro-5-3-EC2-2023-3699,Image SLES15-SP4-SAP-Azure-LI-BYOS-2023-3699,Image SLES15-SP4-SAP-Azure-LI-BYOS-Production-2023-3699,Image SLES15-SP4-SAP-Azure-VLI-BYOS-2023-3699,Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production-2023-3699,SUSE-2023-3699,SUSE-SLE-Micro-5.3-2023-3699,SUSE-SLE-Micro-5.4-2023-3699,SUSE-SLE-Module-Basesystem-15-SP4-2023-3699,SUSE-SLE-Module-Python3-15-SP4-2023-3699,openSUSE-SLE-15.4-2023-3699 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233699-1/ Link for SUSE-SU-2023:3699-1 https://lists.suse.com/pipermail/sle-updates/2023-September/031569.html E-Mail link for SUSE-SU-2023:3699-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1214768 SUSE Bug 1214768 https://www.suse.com/security/cve/CVE-2023-39615/ SUSE CVE CVE-2023-39615 page Container bci/bci-init:15.4 Container bci/python:3 Container suse/manager/4.3/proxy-httpd:latest Container suse/manager/4.3/proxy-salt-broker:latest Container suse/manager/4.3/proxy-squid:latest Container suse/manager/4.3/proxy-ssh:latest Container suse/manager/4.3/proxy-tftpd:latest Container suse/pcp:5 Container suse/postgres:14 Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:latest Container suse/sle-micro/5.3/toolbox:latest Container suse/sle-micro/5.4/toolbox:latest Container suse/sle15:15.4 Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-Micro-5-3 Image SLES15-SP4-Micro-5-3-EC2 Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Python 3 15 SP4 openSUSE Leap 15.4 libxml2-2-2.9.14-150400.5.22.1 python3-libxml2-2.9.14-150400.5.22.1 libxml2-tools-2.9.14-150400.5.22.1 libxml2-2-32bit-2.9.14-150400.5.22.1 libxml2-2-64bit-2.9.14-150400.5.22.1 libxml2-devel-2.9.14-150400.5.22.1 libxml2-devel-32bit-2.9.14-150400.5.22.1 libxml2-devel-64bit-2.9.14-150400.5.22.1 libxml2-doc-2.9.14-150400.5.22.1 python311-libxml2-2.9.14-150400.5.22.1 libxml2-2-2.9.14-150400.5.22.1 as a component of Container bci/bci-init:15.4 libxml2-2-2.9.14-150400.5.22.1 as a component of Container bci/python:3 libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/manager/4.3/proxy-httpd:latest python3-libxml2-2.9.14-150400.5.22.1 as a component of Container suse/manager/4.3/proxy-httpd:latest libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/manager/4.3/proxy-salt-broker:latest libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/manager/4.3/proxy-squid:latest libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/manager/4.3/proxy-ssh:latest libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/manager/4.3/proxy-tftpd:latest libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/pcp:5 libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/postgres:14 libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/sle-micro-rancher/5.3:latest libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/sle-micro-rancher/5.4:latest libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/sle-micro/5.3/toolbox:latest libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/sle-micro/5.4/toolbox:latest libxml2-2-2.9.14-150400.5.22.1 as a component of Container suse/sle15:15.4 libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-CHOST-BYOS libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-CHOST-BYOS-Aliyun libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-CHOST-BYOS-Azure libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-CHOST-BYOS-EC2 libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-CHOST-BYOS-GCE libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-CHOST-BYOS-SAP-CCloud libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS python3-libxml2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure python3-libxml2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 python3-libxml2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE python3-libxml2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS libxml2-tools-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS python3-libxml2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure libxml2-tools-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure python3-libxml2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 libxml2-tools-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 python3-libxml2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE libxml2-tools-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE python3-libxml2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Micro-5-3 libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-Micro-5-3-EC2 libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS libxml2-tools-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS-Production libxml2-tools-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS-Production libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS libxml2-tools-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS libxml2-2-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production libxml2-tools-2.9.14-150400.5.22.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production libxml2-2-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Micro 5.3 libxml2-tools-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Micro 5.3 python3-libxml2-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Micro 5.3 libxml2-2-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Micro 5.4 libxml2-tools-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Micro 5.4 python3-libxml2-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Micro 5.4 libxml2-2-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libxml2-2-32bit-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libxml2-devel-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 libxml2-tools-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 python3-libxml2-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 python311-libxml2-2.9.14-150400.5.22.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP4 libxml2-2-2.9.14-150400.5.22.1 as a component of openSUSE Leap 15.4 libxml2-2-32bit-2.9.14-150400.5.22.1 as a component of openSUSE Leap 15.4 libxml2-devel-2.9.14-150400.5.22.1 as a component of openSUSE Leap 15.4 libxml2-devel-32bit-2.9.14-150400.5.22.1 as a component of openSUSE Leap 15.4 libxml2-doc-2.9.14-150400.5.22.1 as a component of openSUSE Leap 15.4 libxml2-tools-2.9.14-150400.5.22.1 as a component of openSUSE Leap 15.4 python3-libxml2-2.9.14-150400.5.22.1 as a component of openSUSE Leap 15.4 python311-libxml2-2.9.14-150400.5.22.1 as a component of openSUSE Leap 15.4 ** DISPUTED ** Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. CVE-2023-39615 Container bci/bci-init:15.4:libxml2-2-2.9.14-150400.5.22.1 Container bci/python:3:libxml2-2-2.9.14-150400.5.22.1 Container suse/manager/4.3/proxy-httpd:latest:libxml2-2-2.9.14-150400.5.22.1 Container suse/manager/4.3/proxy-httpd:latest:python3-libxml2-2.9.14-150400.5.22.1 Container suse/manager/4.3/proxy-salt-broker:latest:libxml2-2-2.9.14-150400.5.22.1 Container suse/manager/4.3/proxy-squid:latest:libxml2-2-2.9.14-150400.5.22.1 Container suse/manager/4.3/proxy-ssh:latest:libxml2-2-2.9.14-150400.5.22.1 Container suse/manager/4.3/proxy-tftpd:latest:libxml2-2-2.9.14-150400.5.22.1 Container suse/pcp:5:libxml2-2-2.9.14-150400.5.22.1 Container suse/postgres:14:libxml2-2-2.9.14-150400.5.22.1 Container suse/sle-micro-rancher/5.3:latest:libxml2-2-2.9.14-150400.5.22.1 Container suse/sle-micro-rancher/5.4:latest:libxml2-2-2.9.14-150400.5.22.1 Container suse/sle-micro/5.3/toolbox:latest:libxml2-2-2.9.14-150400.5.22.1 Container suse/sle-micro/5.4/toolbox:latest:libxml2-2-2.9.14-150400.5.22.1 Container suse/sle15:15.4:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-CHOST-BYOS-Aliyun:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-CHOST-BYOS-Azure:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-CHOST-BYOS-EC2:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-CHOST-BYOS-GCE:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-CHOST-BYOS-SAP-CCloud:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-CHOST-BYOS:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure:python3-libxml2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2:python3-libxml2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE:python3-libxml2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS:python3-libxml2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:libxml2-tools-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:python3-libxml2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:libxml2-tools-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:python3-libxml2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:libxml2-tools-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:python3-libxml2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:libxml2-tools-2.9.14-150400.5.22.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:python3-libxml2-2.9.14-150400.5.22.1 Image SLES15-SP4-Micro-5-3-EC2:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-Micro-5-3:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:libxml2-tools-2.9.14-150400.5.22.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:libxml2-tools-2.9.14-150400.5.22.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:libxml2-tools-2.9.14-150400.5.22.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:libxml2-2-2.9.14-150400.5.22.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:libxml2-tools-2.9.14-150400.5.22.1 SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.22.1 SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.22.1 SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.22.1 SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.22.1 SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.22.1 SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.22.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:libxml2-2-2.9.14-150400.5.22.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:libxml2-2-32bit-2.9.14-150400.5.22.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:libxml2-devel-2.9.14-150400.5.22.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:libxml2-tools-2.9.14-150400.5.22.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:python3-libxml2-2.9.14-150400.5.22.1 SUSE Linux Enterprise Module for Python 3 15 SP4:python311-libxml2-2.9.14-150400.5.22.1 openSUSE Leap 15.4:libxml2-2-2.9.14-150400.5.22.1 openSUSE Leap 15.4:libxml2-2-32bit-2.9.14-150400.5.22.1 openSUSE Leap 15.4:libxml2-devel-2.9.14-150400.5.22.1 openSUSE Leap 15.4:libxml2-devel-32bit-2.9.14-150400.5.22.1 openSUSE Leap 15.4:libxml2-doc-2.9.14-150400.5.22.1 openSUSE Leap 15.4:libxml2-tools-2.9.14-150400.5.22.1 openSUSE Leap 15.4:python3-libxml2-2.9.14-150400.5.22.1 openSUSE Leap 15.4:python311-libxml2-2.9.14-150400.5.22.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233699-1/ https://www.suse.com/security/cve/CVE-2023-39615.html CVE-2023-39615 https://bugzilla.suse.com/1214768 SUSE Bug 1214768