תיאור (מקור, אנגלית)
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
מוצרים מושפעים
xmlsoft: libxml2; xmlsoft: libxslt; fedoraproject: fedora; debian: debian linux; netapp: active iq unified manager; netapp: clustered data ontap; netapp: clustered data ontap antivirus connector; netapp: manageability software development kit; netapp: ontap select deploy administration utility; netapp: smi-s provider; netapp: snapdrive; netapp: snapmanager; netapp: solidfire \& hci management node; oracle: zfs storage appliance kit; netapp: h300s firmware
קישורים10
- gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e… PatchThird Party Advisory
- gitlab.gnome.org/GNOME/libxml2/-/commit/6c283d83eccd940bcde156… PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
- gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e… PatchThird Party Advisory
- gitlab.gnome.org/GNOME/libxml2/-/commit/6c283d83eccd940bcde156… PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
- packetstormsecurity.com/files/167345/libxml2-xmlBufAdd-Heap-Bu… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/169825/libxml2-xmlParseNameCompl… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/167345/libxml2-xmlBufAdd-Heap-Bu… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/169825/libxml2-xmlParseNameCompl… ExploitThird Party AdvisoryVDB Entry
מדדים
- CVSS 3.1
-
6.5
MEDIUM
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - EPSS — סבירות ניצול
- 4% אחוזון 90 · נכון ל-5 בנובמבר 2026
- CWE
- CWE-190
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.