CVE-2023-28484

MEDIUM6.5EPSS 0.39%

libxml2 - security update

Published: 4/24/2023Modified: 4/28/2026

Description

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

Affected packages (4)

Alpine/libxml2from 0, < 2.10.4-r0
Debian/libxml2from 0, < 2.9.10+dfsg-6.7+deb11u4
Debian/libxml2from 0, < 2.9.4+dfsg1-7+deb10u6
Debian/libxml2from 0, < 2.9.10+dfsg-6.7+deb11u4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2023-28484
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2023-28484