CVE-2022-23308

HIGH

Xmlsoft Libxml2 < 2.9.13 - Use After Free

Title source: rule
STIX 2.1

Description

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

References (19)

Core 19
Core References
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/May/33
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/May/37
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/May/35
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/May/38
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/May/36
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/May/34
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202210-03

Scores

CVSS v3 7.5
EPSS 0.0005
EPSS Percentile 15.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-416
Status published
Products (37)
apple/ipados < 15.5
apple/iphone_os < 15.5
apple/mac_os_x 10.15.7 (12 CPE variants)
apple/mac_os_x 10.15.0 - 10.15.7
apple/macos 11.6.0 - 11.6.6
apple/tvos < 15.5
apple/watchos < 8.6
debian/debian_linux 9.0
fedoraproject/fedora 34
netapp/active_iq_unified_manager
... and 27 more
Published Feb 26, 2022
Tracked Since Feb 18, 2026