Use-after-free vulnerability in libxml2
Summary
CVE-2022-23308: valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. Affects libxml2 across 3 version ranges.
< 2.9.13-r0
< 652dd12a858989b14eed4e84e453059cd3ba340e
< a075d256fd9ff15590b86d981b75a50ead124fca
Fixed in 2.9.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used open-source library for parsing and manipulating XML documents. It provides various functionalities for developers to work with XML data. However, a use-after-free vulnerability has been discovered in libxml2 versions prior to 2.9.13. This vulnerability specifically affects the handling of ID and IDREF attributes in the library.
Vulnerability Detail
The use-after-free vulnerability in libxml2 occurs when the library improperly handles ID and IDREF attributes. An attacker could exploit this vulnerability by crafting a malicious XML document that triggers the use-after-free condition. If successfully exploited, this vulnerability could lead to arbitrary code execution or a denial of service (DoS) attack. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.9.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the fix by updating to the latest version of libxml2.
Conclusion
The use-after-free vulnerability in libxml2 can be mitigated by updating to the latest version of the library. Developers should ensure that their applications are using libxml2 version 2.9.13 or later to protect against potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libxml2 →
FAQ
libxml2 is an open-source library for parsing and manipulating XML documents. It provides various functionalities for developers to work with XML data.
A use-after-free vulnerability occurs when a program continues to use a memory address after it has been freed. In the case of libxml2, this vulnerability relates to the improper handling of ID and IDREF attributes.
If successfully exploited, this vulnerability could lead to arbitrary code execution or a denial of service (DoS) attack. Attackers could craft malicious XML documents to trigger the use-after-free condition and exploit the vulnerability.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to update libxml2 to version 2.9.13 or later. This involves patching the library to address the use-after-free issue.
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
