CVE-2022-23308

Name

CVE-2022-23308

Description

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

Exploits

Forges

GitHub (code, issues), Aports (code, issues)

References

Type	URI
Release Notes	https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS
Patch	https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e
FEDORA	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/
CONFIRM	https://security.netapp.com/advisory/ntap-20220331-0008/
MLIST	https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
CONFIRM	https://support.apple.com/kb/HT213253
CONFIRM	https://support.apple.com/kb/HT213255
CONFIRM	https://support.apple.com/kb/HT213256
CONFIRM	https://support.apple.com/kb/HT213257
CONFIRM	https://support.apple.com/kb/HT213258
CONFIRM	https://support.apple.com/kb/HT213254
Mailing List	http://seclists.org/fulldisclosure/2022/May/33
Mailing List	http://seclists.org/fulldisclosure/2022/May/35
Mailing List	http://seclists.org/fulldisclosure/2022/May/34
Mailing List	http://seclists.org/fulldisclosure/2022/May/37
Mailing List	http://seclists.org/fulldisclosure/2022/May/36
Mailing List	http://seclists.org/fulldisclosure/2022/May/38
Patch	https://www.oracle.com/security-alerts/cpujul2022.html
Third Party Advisory	https://security.gentoo.org/glsa/202210-03
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:xmlsoft:libxml2::::::::`	libxml2	>= None	< 2.9.13

Source package	Branch	Version	Maintainer	Status