CVE-2022-23308
גבוהה 7.5
תיאור (מקור, אנגלית)
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
מדדים
- CVSS 3.1
-
7.5 (HIGH)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — סבירות ניצול
- 5% (אחוזון 100) נכון ל-18/10/2026
- CWE
- CWE-416
מוצרים מושפעים
xmlsoft: libxml2; fedoraproject: fedora; debian: debian linux; apple: ipados; apple: iphone os; apple: mac os x; apple: macos; apple: tvos; apple: watchos; netapp: active iq unified manager; netapp: clustered data ontap; netapp: clustered data ontap antivirus connector; netapp: manageability software development kit; netapp: ontap select deploy administration utility; netapp: smi-s provider
קישורים
- https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
- https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
- http://seclists.org/fulldisclosure/2022/May/33 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/May/34 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/May/35 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/May/36 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/May/37 Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/May/38 Mailing ListThird Party Advisory