CVE-2023-45322: libxml2 - use-after-free in xmlUnlinkNode() in tree.c
Summary
CVE-2023-45322: libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. Affects libxml2 across 2 version ranges.
< 2.9.10+dfsg-6.7+deb11u6
< 2b998a4ffbdfea04fc6a620721abc690a15743af
Fixed in 2.9.10+dfsg-6.7+deb11u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely-used software library for parsing and manipulating XML files. It provides a set of APIs and tools for developers to work with XML data. The vulnerability identified as CVE-2023-45322 affects libxml2 versions up to 2.11.5. This vulnerability is a use-after-free issue that occurs in the xmlUnlinkNode function in the tree.c file. It is important to note that the vendor does not consider this issue critical enough to warrant a CVE ID, as it relies on a specific memory allocation failure that is difficult for an attacker to control.
Vulnerability Detail
The use-after-free vulnerability in libxml2 can be exploited after a specific memory allocation fails. This vulnerability specifically affects the xmlUnlinkNode function in the tree.c file. An attacker could potentially trigger this vulnerability by manipulating XML data in a way that causes a memory allocation failure, leading to a use-after-free condition. Exploiting this vulnerability could result in various consequences, such as crashing the application or potentially executing arbitrary code.
How To Fix
Minimum fixed version
2.9.10+dfsg-6.7+deb11u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the official patches or updates provided by the vendor to address the issue.
Conclusion
The use-after-free vulnerability in libxml2 can be mitigated by updating the package to a version that includes the necessary patches. It is crucial to keep software up to date with the latest security patches to minimize the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libxml2 →
FAQ
libxml2 is a software library for parsing and manipulating XML files. It provides APIs and tools for developers to work with XML data.
Exploiting this vulnerability could lead to crashing the application or potentially executing arbitrary code.
To fix this vulnerability, update the libxml2 package to a version that includes the necessary patches provided by the vendor.
No specific workaround has been provided. It is recommended to apply the official patches or updates.
The vendor does not consider this issue critical enough to warrant a CVE ID, as it relies on a specific memory allocation failure that is difficult for an attacker to control.
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
