Log in Start free

Vulnerability · Published Nov 22, 2022 · Assigned by mitre

CVE-2022-40303

High 7.5

In plain English

A high-severity integer overflow in the libxml2 package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 41.4% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)41.4%top 1.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libxml22.9.7-15.el8_7.1ALSA-2023:0173
AlmaLinux:9libxml22.9.13-3.el9_1ALSA-2023:0338
AlmaLinux:8libxml2-devel2.9.7-15.el8_7.1ALSA-2023:0173
AlmaLinux:9libxml2-devel2.9.13-3.el9_1ALSA-2023:0338
AlmaLinux:8python3-libxml22.9.7-15.el8_7.1ALSA-2023:0173
AlmaLinux:9python3-libxml22.9.13-3.el9_1ALSA-2023:0338
Alpine:v3.20libxml22.10.3-r0ALPINE-CVE-2022-40303
Alpine:v3.21libxml22.10.3-r0ALPINE-CVE-2022-40303
Alpine:v3.22libxml22.10.3-r0ALPINE-CVE-2022-40303
Alpine:v3.23libxml22.10.3-r0ALPINE-CVE-2022-40303
Alpine:v3.24libxml22.10.3-r0ALPINE-CVE-2022-40303
Debian:12libxml22.9.14+dfsg-1.1DEBIAN-CVE-2022-40303
Debian:13libxml22.9.14+dfsg-1.1DEBIAN-CVE-2022-40303
Debian:14libxml22.9.14+dfsg-1.1DEBIAN-CVE-2022-40303
Rocky Linux:8libxml20:2.9.7-15.el8_7.1RLSA-2023:0173
Rocky Linux:9libxml20:2.9.13-3.el9_1RLSA-2023:0338
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.2USN-5760-1
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.2UBUNTU-CVE-2022-40303

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References