CVE-2023-39615
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Version 2.11.0 of the Xmlsoft Libxml2 library was found to contain an out-of-bounds read vulnerability in the xmlSAX2StartElement() function. This allows attackers to cause a Denial of Service (DoS) by supplying a crafted XML file.
Risk Assessment
This vulnerability can lead to system crashes, affecting service availability. Attackers may exploit this flaw to disrupt the operation of applications using this library.
Recommendation
It is recommended to update the Libxml2 library to the latest version to mitigate the risks associated with this vulnerability. Additionally, consider restricting access to functions that process XML files.
Original NVD description (English source)
Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.