PT-2022-5387 · Libxml2+12 · Libxml2+12
Maddie Stone
·
Published
2022-06-22
·
Updated
2025-07-21
·
CVE-2022-40303
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
libxml2 versions prior to 2.10.3
Description
The issue is related to an integer overflow in the
xmlParseNameComplex() function of the libxml2 library when parsing XML documents with the XML PARSE HUGE parser option enabled. This can lead to an attempt to access an array at a negative offset, typically resulting in a segmentation fault. A remote attacker could exploit this issue to execute arbitrary code on the system by persuading a victim to open a specially-crafted file.Recommendations
For libxml2 versions prior to 2.10.3, update to version 2.10.3 or later to resolve the issue. As a temporary workaround, consider disabling the
XML PARSE HUGE parser option when parsing XML documents to minimize the risk of exploitation. Restrict access to the xmlParseNameComplex() function until a patch is available. Avoid using the XML PARSE HUGE option in the affected API endpoint until the issue is resolved.Fix
DoS
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Ibm Aix
Linuxmint
Apple Macos
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Libxml2