← לוח פגיעויות

CVE-2022-29824

בינונית 6.5

תיאור (מקור, אנגלית)

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

מדדים

CVSS 3.1
6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS — סבירות ניצול
4% (אחוזון 100) נכון ל-18/10/2026
CWE
CWE-190

מוצרים מושפעים

xmlsoft: libxml2; xmlsoft: libxslt; fedoraproject: fedora; debian: debian linux; netapp: active iq unified manager; netapp: clustered data ontap; netapp: clustered data ontap antivirus connector; netapp: manageability software development kit; netapp: ontap select deploy administration utility; netapp: smi-s provider; netapp: snapdrive; netapp: snapmanager; netapp: solidfire \& hci management node; oracle: zfs storage appliance kit; netapp: h300s firmware

קישורים