6.5

CVE-2023-39615: xmlsoft libxml2

CVSS: 6.5v3.1MediumModified
AliasesMGASA-2023-0279SUSE-SU-2023:3666-1SUSE-SU-2023:3666-2
Published 29-08-2023Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2023-39615 is a medium (CVSS 6.5) vulnerability in xmlsoft libxml2. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
1.08%
0%100%
Low · +0.32 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 4 · Related 1
DLA-4064-1DSA-5949-1RHSA-2024:0413SUSE-SU-2023:3665-1

Timeline

  1. 29-08-2023
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

1.08%

Chance of exploitation in the next 30 days

Percentile

65%

Versus all other CVEs

30-day change

+0.32 pp

From 0.76% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.08%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (gitlab.gnome.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse43 products
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.3< 2.9.14-150400.5.22.1
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.4< 2.9.14-150400.5.22.1
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.5< 2.10.3-150500.5.8.1
  • libxml2-python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 2.9.14-150400.5.22.1
  • libxml2-python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 2.10.3-150500.5.8.1
Opensuse7 products
  • libxml2-python&distro=openSUSE Leap 15.4< 2.9.14-150400.5.22.1
  • libxml2-python&distro=openSUSE Leap 15.5< 2.10.3-150500.5.8.1
  • libxml2&distro=openSUSE Leap 15.4< 2.9.14-150400.5.22.1
  • libxml2&distro=openSUSE Leap 15.5< 2.10.3-150500.5.8.1
  • libxml2&distro=openSUSE Tumbleweed< 2.10.4-3.1
Redhat6 products
  • libxml2< 0:2.9.7-16.el8_8.2 | < 0:2.9.13-5.el9_3 | < 0:2.9.7-18.el8_9
  • libxml2-debuginfo< 0:2.9.7-16.el8_8.2 | < 0:2.9.13-5.el9_3 | < 0:2.9.7-18.el8_9
  • libxml2-debugsource< 0:2.9.7-16.el8_8.2 | < 0:2.9.13-5.el9_3 | < 0:2.9.7-18.el8_9
  • libxml2-devel< 0:2.9.7-16.el8_8.2 | < 0:2.9.13-5.el9_3 | < 0:2.9.7-18.el8_9
  • python3-libxml2< 0:2.9.7-16.el8_8.2 | < 0:2.9.13-5.el9_3 | < 0:2.9.7-18.el8_9
Mageia2 products
  • libxml2< 2.9.10-7.8.mga8
  • libxml2< 2.10.4-1.1.mga9
Debian1 product
  • libxml2< 2.9.14+dfsg-1.3~deb12u2 | < 2.12.7+dfsg+really2.9.14-1
Xmlsoft1 product

6 vendors · 60 products

References

27 links
Show all 27 references