All errata/sisyphus/ALT-PU-2023-8083-3
ALT-PU-2023-8083-3

Package update libxml2 in branch sisyphus

Version2.12.3-alt1
Task#336543
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (4)

BDU:2023-06827
MEDIUM6.5

Уязвимость функции xmlUnlinkNode (tree.c) библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2023-10-17Modified: 2026-03-04
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2025-11749
HIGH8.1

Уязвимость функции xmlXIncludeAddNode() файла xinclude.c библиотеки libxml2, позволяющая нарушителю скомпрометировать уязвимую систему

Published: 2025-09-26Modified: 2026-03-04
CVSS 3.xHIGH 8.1
CVSS:3.x/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0MEDIUM 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:C
References
CVE-2023-45322
MEDIUM6.5

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Published: 2023-10-06Modified: 2025-11-03
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References