libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

🗓️ 12 Oct 2023 07:00:00Reported by MicrosoftType

Libxml2 up to 2.11.5 has a use-after-free in xmlUnlinkNode after an allocation failure.

Reporter	Title	Published	Views	Family All 113
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues	19 Jun 202517:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Use After Free in the RHEL UBI (CVE-2024-25062, CVE-2023-39615, CVE-2023-45322)	27 Jun 202520:01	–	ibm
Tenable Nessus	Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2023-411)	4 Nov 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : libxml2 (ALAS-2023-2321)	2 Nov 202300:00	–	nessus
Tenable Nessus	Amazon Linux AMI : libxml2 (ALAS-2023-1874)	3 Nov 202300:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: libxml2 (CVE-2023-45322)	11 Feb 202500:00	–	nessus
Tenable Nessus	Debian dla-4064 : libxml2 - security update	22 Feb 202500:00	–	nessus
Tenable Nessus	Debian dsa-5949 : libxml2 - security update	26 Jun 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP11 : libxml2 (EulerOS-SA-2023-3250)	16 Jan 202400:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP11 : libxml2 (EulerOS-SA-2023-3278)	16 Jan 202400:00	–	nessus