CVE-2023-29469

Name	CVE-2023-29469
Description	An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-3405-1, DSA-5391-1
Debian Bugs	1034437

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libxml2 (PTS)	buster	2.9.4+dfsg1-7+deb10u4	vulnerable
	buster (security)	2.9.4+dfsg1-7+deb10u6	fixed
	bullseye, bullseye (security)	2.9.10+dfsg-6.7+deb11u4	fixed
	bookworm, sid	2.9.14+dfsg-1.2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libxml2	source	buster	2.9.4+dfsg1-7+deb10u6	DLA-3405-1
libxml2	source	bullseye	2.9.10+dfsg-6.7+deb11u4	DSA-5391-1
libxml2	source	(unstable)	2.9.14+dfsg-1.2		1034437

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2185984
https://gitlab.gnome.org/GNOME/libxml2/-/issues/510
Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64 (v2.10.4)