CVE-2023-39615
Fixed in a distro release EPSS 1%
Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.
Products: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SINEC NMS, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | libxml2 | 2.9.7-18.el8_9 |
| AlmaLinux 8 | libxml2-devel | 2.9.7-18.el8_9 |
| AlmaLinux 8 | python3-libxml2 | 2.9.7-18.el8_9 |
| AlmaLinux 9 | libxml2 | 2.9.13-5.el9_3 |
| AlmaLinux 9 | libxml2-devel | 2.9.13-5.el9_3 |
| AlmaLinux 9 | python3-libxml2 | 2.9.13-5.el9_3 |
| Amazon Linux 2 | libxml2 | 2.9.1-6.amzn2.5.11 |
| Amazon Linux 2 | libxml2-devel | 2.9.1-6.amzn2.5.11 |
| Amazon Linux 2 | libxml2-python | 2.9.1-6.amzn2.5.11 |
| Amazon Linux 2 | libxml2-static | 2.9.1-6.amzn2.5.11 |
| Amazon Linux 2023 | libxml2 | 2.10.4-1.amzn2023.0.4 |
| Amazon Linux 2023 | libxml2-devel | 2.10.4-1.amzn2023.0.4 |
| Amazon Linux 2023 | libxml2-static | 2.10.4-1.amzn2023.0.4 |
| Amazon Linux 2023 | python3-libxml2 | 2.10.4-1.amzn2023.0.4 |
| Debian 11 | libxml2 | 2.9.10+dfsg-6.7+deb11u6 |
| Debian 12 | libxml2 | 2.9.14+dfsg-1.3~deb12u2 |
| Debian 13 | libxml2 | 2.12.7+dfsg+really2.9.14-1 |
| Debian 14 | libxml2 | 2.12.7+dfsg+really2.9.14-1 |
| Red Hat Enterprise Linux 8 | libxml2 | 0:2.9.7-18.el8_9 |
| Red Hat Enterprise Linux 8 | libxml2-debuginfo | 0:2.9.7-18.el8_9 |
| Red Hat Enterprise Linux 8 | libxml2-debugsource | 0:2.9.7-18.el8_9 |
| Red Hat Enterprise Linux 8 | libxml2-devel | 0:2.9.7-18.el8_9 |
| Red Hat Enterprise Linux 8 | python3-libxml2 | 0:2.9.7-18.el8_9 |
| Red Hat Enterprise Linux 8 | python3-libxml2-debuginfo | 0:2.9.7-18.el8_9 |
| Red Hat Enterprise Linux 9 | libxml2 | 0:2.9.13-5.el9_3 |
| Red Hat Enterprise Linux 9 | libxml2-debuginfo | 0:2.9.13-5.el9_3 |
| Red Hat Enterprise Linux 9 | libxml2-debugsource | 0:2.9.13-5.el9_3 |
| Red Hat Enterprise Linux 9 | libxml2-devel | 0:2.9.13-5.el9_3 |
| Red Hat Enterprise Linux 9 | python3-libxml2 | 0:2.9.13-5.el9_3 |
| Red Hat Enterprise Linux 9 | python3-libxml2-debuginfo | 0:2.9.13-5.el9_3 |
| Red Hat rhel eus 8.6 | libxml2 | 0:2.9.7-13.el8_6.4 |
| Red Hat rhel eus 8.6 | libxml2-debuginfo | 0:2.9.7-13.el8_6.4 |
| Red Hat rhel eus 8.6 | libxml2-debugsource | 0:2.9.7-13.el8_6.4 |
| Red Hat rhel eus 8.6 | libxml2-devel | 0:2.9.7-13.el8_6.4 |
| Red Hat rhel eus 8.6 | python3-libxml2 | 0:2.9.7-13.el8_6.4 |
| Red Hat rhel eus 8.6 | python3-libxml2-debuginfo | 0:2.9.7-13.el8_6.4 |
| Red Hat rhel eus 8.8 | libxml2 | 0:2.9.7-16.el8_8.2 |
| Red Hat rhel eus 8.8 | libxml2-debuginfo | 0:2.9.7-16.el8_8.2 |
| Red Hat rhel eus 8.8 | libxml2-debugsource | 0:2.9.7-16.el8_8.2 |
| Red Hat rhel eus 8.8 | libxml2-devel | 0:2.9.7-16.el8_8.2 |
| Red Hat rhel eus 8.8 | python3-libxml2 | 0:2.9.7-16.el8_8.2 |
| Red Hat rhel eus 8.8 | python3-libxml2-debuginfo | 0:2.9.7-16.el8_8.2 |
| Rocky Linux 8 | libxml2 | 0:2.9.7-18.el8 |
| Rocky Linux 8 | libxml2 | 0:2.9.7-18.el8_9 |
| SUSE Enterprise Storage 7 | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Enterprise Storage 7 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Enterprise Storage 7.1 | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Enterprise Storage 7.1 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Micro 5.1 | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Micro 5.2 | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Micro 5.2 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Micro 5.3 | libxml2 | 2.9.14-150400.5.22.1 |
| SUSE Linux Enterprise Micro 5.3 | libxml2-python | 2.9.14-150400.5.22.1 |
| SUSE Linux Enterprise Micro 5.4 | libxml2 | 2.9.14-150400.5.22.1 |
| SUSE Linux Enterprise Micro 5.4 | libxml2-python | 2.9.14-150400.5.22.1 |
| SUSE Linux Enterprise Micro 5.5 | libxml2 | 2.10.3-150500.5.8.1 |
| SUSE Linux Enterprise Micro 5.5 | libxml2-python | 2.10.3-150500.5.8.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | libxml2 | 2.9.14-150400.5.22.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | libxml2-python | 2.9.14-150400.5.22.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | libxml2 | 2.10.3-150500.5.8.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | libxml2-python | 2.10.3-150500.5.8.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP4 | libxml2-python | 2.9.14-150400.5.22.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | libxml2-python | 2.10.3-150500.5.8.1 |
| SUSE Linux Enterprise Server 12 SP5 | libxml2 | 2.9.4-46.65.1 |
| SUSE Linux Enterprise Server 12 SP5 | python-libxml2 | 2.9.4-46.65.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | libxml2 | 2.9.4-46.65.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | python-libxml2 | 2.9.4-46.65.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | libxml2 | 2.9.4-46.65.1 |
| SUSE Manager Proxy 4.2 | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Manager Proxy 4.2 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| SUSE Manager Server 4.2 | libxml2 | 2.9.7-150000.3.60.1 |
| SUSE Manager Server 4.2 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| openSUSE Leap 15.4 | libxml2 | 2.9.14-150400.5.22.1 |
| openSUSE Leap 15.4 | libxml2-python | 2.9.14-150400.5.22.1 |
| openSUSE Leap 15.4 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| openSUSE Leap 15.5 | libxml2 | 2.10.3-150500.5.8.1 |
| openSUSE Leap 15.5 | libxml2-python | 2.10.3-150500.5.8.1 |
| openSUSE Leap 15.5 | python-libxml2-python | 2.9.7-150000.3.60.1 |
| openSUSE Tumbleweed | libxml2 | 2.10.4-3.1 |