CVE-2023-39615
Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.
- Affected products
- Almalinux, Astra Linux, Centos, Debian, Libxml2, Red Hat, Rocky Linux, Suse
- Xmlsoft libxml2
- = 2.11.0
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 0.7% (48th percentile)
- Weakness
- CWE-119
- NVD status
- Modified
- Published
- 2023-08-29
CVE-2023-39615 at NVD
No indexed exploits for CVE-2023-39615 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2023-39615 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.