Non-Deterministic Value Generation in libxml2 Affects Multiple Applications

CVE-2023-29469

What is CVE-2023-29469?

A vulnerability in libxml2, present in versions prior to 2.10.4, arises during the handling of empty dictionary strings in XML documents. The function xmlDictComputeFastKey can yield unexpected non-deterministic values due to improper attempts to process the first byte of an empty string. This leads to potential logic and memory errors, including issues such as double free, because any value can be generated instead of a standard null terminator ('\0'). Developers are encouraged to update to the latest release to mitigate associated risks.

References