CVE-2022-23308

EPSS 6.01%
Veröffentlicht 26.02.2022 05:15:08
Zuletzt bearbeitet 05.05.2025 17:17:56
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 22

NVD 47 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Xmlsoft ≫ Libxml2 Version < 2.9.13

Fedoraproject ≫ Fedora Version34

Debian ≫ Debian Linux Version9.0

Apple ≫ iPadOS Version < 15.5

Apple ≫ iPhone OS Version < 15.5

Apple ≫ macOS X Version >= 10.15.0 < 10.15.7

Apple ≫ macOS X Version10.15.7

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2020-001

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2021-001

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2021-002

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2021-003

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2021-004

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2021-005

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2021-006

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2021-007

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2021-008

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2022-001

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2022-003

Apple ≫ macOS Version >= 11.6.0 < 11.6.6

Apple ≫ macOS Version >= 12.0 < 12.4

Apple ≫ tvOS Version < 15.5

Apple ≫ watchOS Version < 8.6

Netapp ≫ Active Iq Unified Manager Version- SwPlatformvmware_vsphere

Netapp ≫ Clustered Data Ontap Version-

Netapp ≫ Clustered Data Ontap Antivirus Connector Version-

Netapp ≫ Manageability Software Development Kit Version-

Netapp ≫ Ontap Select Deploy Administration Utility Version-

Netapp ≫ Smi-s Provider Version-

Netapp ≫ Snapdrive Version- SwPlatformunix

Netapp ≫ Snapmanager Version- SwPlatformoracle

Netapp ≫ Bootstrap Os Version-

Netapp ≫ Hci Compute Node Version-

Netapp ≫ H300s Firmware Version-

Netapp ≫ H300s Version-

Netapp ≫ H500s Firmware Version-

Netapp ≫ H500s Version-

Netapp ≫ H700s Firmware Version-

Netapp ≫ H700s Version-

Netapp ≫ H300e Firmware Version-

Netapp ≫ H300e Version-

Netapp ≫ H500e Firmware Version-

Netapp ≫ H500e Version-

Netapp ≫ H700e Firmware Version-

Netapp ≫ H700e Version-

Netapp ≫ H410s Firmware Version-

Netapp ≫ H410s Version-

Netapp ≫ H410c Firmware Version-

Netapp ≫ H410c Version-

Oracle ≫ Communications Cloud Native Core Binding Support Function Version22.2.0

Oracle ≫ Communications Cloud Native Core Network Function Cloud Native Environment Version22.1.0

Oracle ≫ Communications Cloud Native Core Network Repository Function Version22.1.2

Oracle ≫ Communications Cloud Native Core Network Repository Function Version22.2.0

Oracle ≫ Communications Cloud Native Core Network Slice Selection Function Version22.1.1

Oracle ≫ Communications Cloud Native Core Unified Data Repository Version22.2.0

Oracle ≫ Mysql Workbench Version <= 8.0.29

Oracle ≫ Zfs Storage Appliance Kit Version8.8

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	6.01%	0.924

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:N/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://seclists.org/fulldisclosure/2022/May/34

Third Party Advisory

Mailing List

https://support.apple.com/kb/HT213258

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Patch

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html

Third Party Advisory

Mailing List

http://seclists.org/fulldisclosure/2022/May/35

Third Party Advisory

Mailing List

https://support.apple.com/kb/HT213256

Third Party Advisory

http://seclists.org/fulldisclosure/2022/May/33

Third Party Advisory

Mailing List

http://seclists.org/fulldisclosure/2022/May/38

Third Party Advisory

Mailing List

https://support.apple.com/kb/HT213255

Third Party Advisory

https://support.apple.com/kb/HT213257

Third Party Advisory

http://seclists.org/fulldisclosure/2022/May/36

Third Party Advisory

Mailing List

http://seclists.org/fulldisclosure/2022/May/37

Third Party Advisory

Mailing List

https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e

Patch

Third Party Advisory

https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS

Third Party Advisory

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/

https://security.gentoo.org/glsa/202210-03

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220331-0008/

Third Party Advisory

https://support.apple.com/kb/HT213253

Third Party Advisory

https://support.apple.com/kb/HT213254

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-23308

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-23308

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-23308

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2022-23308