6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-39615

CVE-2023-39615: Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the...

Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-39615

CVE-2023-39615:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is consistently identified in the xmlSAX2StartElement function within the SAX2.c file across multiple reliable sources (NVD, GitHub Advisory, Debian Security Tracker). Although direct patch analysis was not possible due to limitations in fetching GitLab commit details, the consensus from these sources provides high confidence in identifying this function as the site of the vulnerability. The vendor's dispute highlights a specific condition (legacy SAX1 interface with custom callbacks) under which the vulnerability manifests.

Initially, I attempted to fetch content from all provided URLs. The GitLab issue link was inaccessible due to bot protection. I then tried to get commit URLs from the GitLab issue, which returned no results. Subsequently, I searched for CVE details on Google, which confirmed the vulnerable function but didn't provide direct patch links. A further search on the Debian Security Tracker for the CVE yielded two GitLab commit URLs that purportedly fix the vulnerability. However, an attempt to fetch details for these GitLab commits using get_commit_infos failed, likely because the tool is primarily for GitHub.

Despite the inability to analyze the patch directly, the consistent reporting across NVD, GitHub Advisory, and the Debian Security Tracker, all pointing to xmlSAX2StartElement in SAX2.c, allows for a high-confidence identification of the vulnerable function. The vendor's statement about the SAX1 interface provides context on the trigger conditions but doesn't negate the vulnerability in the specified function under those conditions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.