CVE-2022-23308

EPSS 6.01%
Veröffentlicht 26.02.2022 05:15:08
Zuletzt bearbeitet 05.05.2025 17:17:56
Erkennungen
Login

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 22

NVD 47 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Xmlsoft ≫ Libxml2 Version < 2.9.13

Fedoraproject ≫ Fedora Version 34

Debian ≫ Debian Linux Version 9.0

Apple ≫ iPadOS Version < 15.5

Apple ≫ iPhone OS Version < 15.5

Apple ≫ macOS X Version >= 10.15.0 < 10.15.7

Apple ≫ macOS X Version 10.15.7

Apple ≫ macOS X Version 10.15.7 Update security_update_2020-001

Apple ≫ macOS X Version 10.15.7 Update security_update_2021-001

Apple ≫ macOS X Version 10.15.7 Update security_update_2021-002

Apple ≫ macOS X Version 10.15.7 Update security_update_2021-003

Apple ≫ macOS X Version 10.15.7 Update security_update_2021-004

Apple ≫ macOS X Version 10.15.7 Update security_update_2021-005

Apple ≫ macOS X Version 10.15.7 Update security_update_2021-006

Apple ≫ macOS X Version 10.15.7 Update security_update_2021-007

Apple ≫ macOS X Version 10.15.7 Update security_update_2021-008

Apple ≫ macOS X Version 10.15.7 Update security_update_2022-001

Apple ≫ macOS X Version 10.15.7 Update security_update_2022-003

Apple ≫ macOS Version >= 11.6.0 < 11.6.6

Apple ≫ macOS Version >= 12.0 < 12.4

Apple ≫ tvOS Version < 15.5

Apple ≫ watchOS Version < 8.6

Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere

Netapp ≫ Clustered Data Ontap Version -

Netapp ≫ Clustered Data Ontap Antivirus Connector Version -

Netapp ≫ Manageability Software Development Kit Version -

Netapp ≫ Ontap Select Deploy Administration Utility Version -

Netapp ≫ Smi-s Provider Version -

Netapp ≫ Snapdrive Version - SwPlatform unix

Netapp ≫ Snapmanager Version - SwPlatform oracle

Netapp ≫ Bootstrap Os Version -

Netapp ≫ Hci Compute Node Version -

Netapp ≫ H300s Firmware Version -

Netapp ≫ H300s Version -

Netapp ≫ H500s Firmware Version -

Netapp ≫ H500s Version -

Netapp ≫ H700s Firmware Version -

Netapp ≫ H700s Version -

Netapp ≫ H300e Firmware Version -

Netapp ≫ H300e Version -

Netapp ≫ H500e Firmware Version -

Netapp ≫ H500e Version -

Netapp ≫ H700e Firmware Version -

Netapp ≫ H700e Version -

Netapp ≫ H410s Firmware Version -

Netapp ≫ H410s Version -

Netapp ≫ H410c Firmware Version -

Netapp ≫ H410c Version -

Oracle ≫ Communications Cloud Native Core Binding Support Function Version 22.2.0

Oracle ≫ Communications Cloud Native Core Network Function Cloud Native Environment Version 22.1.0

Oracle ≫ Communications Cloud Native Core Network Repository Function Version 22.1.2

Oracle ≫ Communications Cloud Native Core Network Repository Function Version 22.2.0

Oracle ≫ Communications Cloud Native Core Network Slice Selection Function Version 22.1.1

Oracle ≫ Communications Cloud Native Core Unified Data Repository Version 22.2.0

Oracle ≫ Mysql Workbench Version <= 8.0.29

Oracle ≫ Zfs Storage Appliance Kit Version 8.8

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	6.01%	0.924

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:N/A:P
CISA-ADP	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://seclists.org/fulldisclosure/2022/May/34

Third Party Advisory

Mailing List

https://support.apple.com/kb/HT213258

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Patch

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html

Third Party Advisory

Mailing List

http://seclists.org/fulldisclosure/2022/May/35

Third Party Advisory

Mailing List

https://support.apple.com/kb/HT213256

Third Party Advisory

http://seclists.org/fulldisclosure/2022/May/33

Third Party Advisory

Mailing List

http://seclists.org/fulldisclosure/2022/May/38

Third Party Advisory

Mailing List

https://support.apple.com/kb/HT213255

Third Party Advisory

https://support.apple.com/kb/HT213257

Third Party Advisory

http://seclists.org/fulldisclosure/2022/May/36

Third Party Advisory

Mailing List

http://seclists.org/fulldisclosure/2022/May/37

Third Party Advisory

Mailing List

https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e

Patch

Third Party Advisory

https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS

Third Party Advisory

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/

https://security.gentoo.org/glsa/202210-03

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220331-0008/

Third Party Advisory

https://support.apple.com/kb/HT213253

Third Party Advisory

https://support.apple.com/kb/HT213254

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-23308

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-23308

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-23308

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2022-23308