The vulnerability of the valid.c file in the XML document analysis library libxml2, related to memory usage after deallocation, allows an attacker to execute arbitrary code.

🗓️ 25 Mar 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 8 Views

Libxml2 valid.c vulnerability causes memory after free, enabling remote code execution via a crafted XML file.

Reporter	Title	Published	Views	Family All 257
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Identity Insight vulnerabilities in third party libraries (CVE-2021-39239, CVE-2022-23308, CVE-2021-29424, CVE-2020-15250, 177835)	16 Aug 202219:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from expat, Golang Go, gcc, openssl and libxml.	16 May 202206:59	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties Affecting Watson Machine Learning Accelerator on Cloud Pak for Data version	13 Nov 202315:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	26 Jul 202214:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security is vulnerable to using components with known vulnerabilities	28 Oct 202219:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities fixed in IBM Security Verify Access Appliance (CVE-2022-23308, CVE-2021-23840, CVE-2021-23841, CVE-2021-3712)	6 Jul 202218:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in libxml2 affects IBM Integrated Analytics System [CVE-2022-23308]	26 Sep 202414:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	19 Jan 202313:54	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.6 contains fixes for multiple security vulnerabilities.	25 Oct 202213:11	–	ibm
ALT Linux	Security fix for the ALT Linux 10 package libxml2 version 1:2.9.12-alt1.p10.1	2 Feb 202300:00	–	altlinux

Source	Link
redos	www.redos.red-soft.ru/support/secure/
goslinux	www.goslinux.fssp.gov.ru/2726972/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-23308
github	www.github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20221220SE16

01 Jun 2026 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 39.8

CVSS 210

EPSS0.0601

libxml2 memory after free arbitrary code execution remote attack xml file valid c