CVE-2022-23308

CVE-2022-23308 affects libxml2 before 2.9.13, caused by a use-after-free in ID/IDREF attributes in valid.c. The NVD data shows a CVSS 3.1 base score of 7.5 (NETWORK, PR:N, UI:N, S:U, C:N/I:N/A:H) and CVSS 2.0 base score of 4.3 (NETWORK, A:P). Connected advisories confirm the same flaw and referen...

CVE-2022-40303

A vulnerability in libxml2 before version 2.10.3 allows for an integer overflow when parsing multi-gigabyte XML documents with the XML_PARSE_HUGE option enabled. This flaw results in an attempt to access an array at a negative 2GB offset , typically causing a segmentation fault . Impacted systems...

CVE-2022-29824

Summary: CVE-2022-29824 affects libxml2 up to version 2.9.14. Several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) fail to check integer overflows, causing out-of-bounds memory writes when processing crafted XML files. This vulnerability also affects software that uses lib...

CVE-2016-3709

CVE-2016-3709 is a vulnerability in the libxml2 HTML 4 parser. The issue arises after commit 960f0e2 and enables cross-site scripting. Public advisories confirm impact on libxml2 and list fixed versions: Debian Bullseye fixes in 2.9.10+dfsg-6.7+deb11u5; AlmaLinux notes an XSS fix; Cloud Foundry a...

CVE-2022-40304

An issue was discovered in libxml2 before version 2.10.3 where certain invalid XML entity definitions can corrupt a hash table key. This corruption can lead to subsequent logic errors, and in some instances, a double-free can be provoked. Vulnerable products include AIX (7.2, 7.3), VIOS (3.1), an...