תיאור (מקור, אנגלית)
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.
מוצרים מושפעים
xmlsoft: libxml2; netapp: active iq unified manager; netapp: clustered data ontap; netapp: clustered data ontap antivirus connector; netapp: manageability software development kit; netapp: smi-s provider; netapp: snapmanager; netapp: h300s firmware; netapp: h300s; netapp: h500s firmware; netapp: h500s; netapp: h700s firmware; netapp: h700s; netapp: h410s firmware; netapp: h410s
קישורים10
- gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376b… PatchThird Party Advisory
- gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3 PatchRelease NotesThird Party Advisory
- gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376b… PatchThird Party Advisory
- gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3 PatchRelease NotesThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/21 Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/24 Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/25 Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/26 Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Dec/27
- gitlab.gnome.org/GNOME/libxml2/-/tags Release NotesThird Party Advisory
מדדים
- CVSS 3.1
-
7.8
HIGH
מקור הציון: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 6% אחוזון 93 · נכון ל-6 בנובמבר 2026
- CWE
- CWE-415
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.