CVE-2023-29469: debian debian_linux Double Free
Vulnerability summary
CVE-2023-29469 is a medium (CVSS 6.5) Double Free vulnerability in debian debian_linux. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 69.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 16 · Related 10Timeline
- 24-04-2023PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.30%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
+0.29 pp
From 1.00% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- libxml2< 2.9.14+dfsg-1.2
- debian_linuxEOL10.0
Alpine1 product
- libxml2< 2.10.4-r0
Ubuntu1 product
- libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm5 | < 2.9.3+dfsg1-1ubuntu0.7+esm5 | < 2.9.4+dfsg1-6.1ubuntu1.9 | < 2.9.10+dfsg-5ubuntu0.20.04.6 | < 2.9.13+dfsg-1ubuntu0.3
Xmlsoft1 product
- libxml2< 2.10.4
4 vendors · 5 products
