PT-2022-1917 · Libxml2+11 · Libxml2+11

Published 2022-02-19 · Updated 2026-03-13 · CVE-2022-23308

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.13

Description The issue is related to a use-after-free of ID and IDREF attributes in the valid.c file of the libxml2 library, which is used for XML document analysis. This can be exploited by a remote attacker to execute arbitrary code by sending a specially crafted XML file.

Recommendations For versions prior to 2.9.13, update to version 2.9.13 or later to resolve the issue. As a temporary workaround, consider restricting the use of the valid.c file or the affected ID and IDREF attributes until a patch is available.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2022:0899

ALT-PU-2022-1807

ALT-PU-2022-3377

ALT-PU-2023-1172

AZL-8862

BDU:2022-01453

CESA-2022_0899

CVE-2022-23308

DLA-2972-1

MGASA-2022-0084

OESA-2022-1582

OESA-2022-2082

OPENSUSE-SU-2022:0802-1

OPENSUSE-SU-2022_0802-1

OPENSUSE-SU-2022_1750-1

OPENSUSE-SU-2022_2552-1

OPENSUSE-SU-2024:11912-1

OPENSUSE-SU-2024:11950-1

OPENSUSE-SU-2024:13165-1

OPENSUSE-SU-2024:14174-1

OPENSUSE-SU-2025:14697-1

OPENSUSE-SU-2026:10356-1

RHSA-2022:0899

RHSA-2022:1389

RHSA-2022_0899

RLSA-2022:0899

SUSE-SU-2022:0802-1

SUSE-SU-2022:0802-2

SUSE-SU-2022:1308-1

SUSE-SU-2022:14904-1

SUSE-SU-2022:1750-1

SUSE-SU-2022:2552-1

SUSE-SU-2022_0802-1

SUSE-SU-2022_1308-1

SUSE-SU-2022_14904-1

SUSE-SU-2022_1750-1

SUSE-SU-2022_2552-1

USN-5324-1

USN-5422-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Apple Macos

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libxml2

References · 147

• https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e · Patch
• https://safe-surf.ru/specialists/bulletins-nkcki/688413 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-40304 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-23308 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11950-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/695584 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23308 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23308 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/676109 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23308 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11912-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1308-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0084.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:0802-2 · Vendor Advisory