PT-2022-5386 · Libxml2+12 · Libxml2+12
Nathan Wachholz
+1
·
Published
2022-06-22
·
Updated
2025-04-28
·
CVE-2022-40304
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
libxml2 versions prior to 2.10.3
Description
An issue was discovered in libxml2 where certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked, which may allow a remote attacker to cause a denial of service. The vulnerability is related to the handling of objects with a dict structure, where the value of the first byte is zero. This issue can be exploited by a remote attacker to cause a denial of service.
Recommendations
For libxml2 versions prior to 2.10.3, update to version 2.10.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XML PARSE HUGE function to minimize the risk of exploitation. Additionally, avoid using specially-crafted files that could provoke the double-free error until the issue is resolved.
Fix
DoS
Integer Overflow
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Ibm Aix
Linuxmint
Apple Macos
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Libxml2