In libxml2 before 2.9.14 several buffer handling functions in buf.c (xmlBuf) and tree.c (xmlBuffer) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted multi-gigabyte XML file. Other software using libxml2's buffer functions for example libxslt through 1.1.35 is affected as well.

🗓️ 11 May 2022 07:00:00Reported by MicrosoftType

Libxml2 before 2.9.14 may overflow buffers, causing out-of-bounds writes on large XML files.

Reporter	Title	Published	Views	Family All 242
zdt	libxml2 xmlBufAdd Heap Buffer Overflow Exploit	2 Jun 202200:00	–	zdt
zdt	libxml2 xmlParseNameComplex Integer Overflow Vulnerability	16 Nov 202200:00	–	zdt
ALT Linux	Security fix for the ALT Linux 10 package libxml2 version 1:2.9.12-alt1.p10.1	2 Feb 202300:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from Golang Go, libxml2, curl, expat, libgcrypt and IBM WebSphere Application Server Liberty	9 Aug 202205:46	–	ibm
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to a denial of service due to libxml2 (CVE-2022-29824)	31 Oct 202321:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to CVE-2022-29824	7 Nov 202210:54	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities.	15 Dec 202209:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNOME libxml2 (CVE-2022-29824)	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	27 Feb 202317:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	19 Jan 202313:54	–	ibm