Search for vulnerabilities
Vulnerability details: VCID-wunb-embq-aaaq
Vulnerability ID VCID-wunb-embq-aaaq
Aliases CVE-2023-29469
Summary Double Free An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-415 Double Free
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-20 Improper Input Validation
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-29469.json
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00133 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.00886 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
epss 0.01831 https://api.first.org/data/v1/epss?cve=CVE-2023-29469
generic_textual MODERATE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484
generic_textual MODERATE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.5 https://gitlab.gnome.org/GNOME/libxml2/-/issues/510
ssvc Track https://gitlab.gnome.org/GNOME/libxml2/-/issues/510
cvssv3.1 6.5 https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4
generic_textual MODERATE https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4
ssvc Track https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4
cvssv3.1 6.5 https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html
ssvc Track https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-29469
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-29469
cvssv3.1 6.5 https://security.netapp.com/advisory/ntap-20230601-0006/
ssvc Track https://security.netapp.com/advisory/ntap-20230601-0006/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-29469.json
https://api.first.org/data/v1/epss?cve=CVE-2023-29469
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://gitlab.gnome.org/GNOME/libxml2/-/issues/510
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4
https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html
https://nokogiri.org/CHANGELOG.html#1143-2023-04-11
https://security.netapp.com/advisory/ntap-20230601-0006/
1034437 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034437
2185984 https://bugzilla.redhat.com/show_bug.cgi?id=2185984
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2023-29469 https://nvd.nist.gov/vuln/detail/CVE-2023-29469
GLSA-202402-11 https://security.gentoo.org/glsa/202402-11
RHSA-2023:4349 https://access.redhat.com/errata/RHSA-2023:4349
RHSA-2023:4529 https://access.redhat.com/errata/RHSA-2023:4529
RHSA-2023:4628 https://access.redhat.com/errata/RHSA-2023:4628
RHSA-2024:0413 https://access.redhat.com/errata/RHSA-2024:0413
USN-6028-1 https://usn.ubuntu.com/6028-1/
USN-6028-2 https://usn.ubuntu.com/6028-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-29469.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://gitlab.gnome.org/GNOME/libxml2/-/issues/510
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-04T21:02:27Z/ Found at https://gitlab.gnome.org/GNOME/libxml2/-/issues/510
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-04T21:02:27Z/ Found at https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-04T21:02:27Z/ Found at https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-29469
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-29469
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20230601-0006/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-04T21:02:27Z/ Found at https://security.netapp.com/advisory/ntap-20230601-0006/
Exploit Prediction Scoring System (EPSS)
Percentile 0.12987
EPSS Score 0.00044
Published At April 15, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.