Log in Start free

Vulnerability · Published Nov 23, 2022 · Assigned by mitre

CVE-2022-40304

High 7.8

In plain English

A high-severity double free in the libxml2 package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.8% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)5.8%top 6.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libxml22.9.7-15.el8_7.1ALSA-2023:0173
AlmaLinux:9libxml22.9.13-3.el9_1ALSA-2023:0338
AlmaLinux:8libxml2-devel2.9.7-15.el8_7.1ALSA-2023:0173
AlmaLinux:9libxml2-devel2.9.13-3.el9_1ALSA-2023:0338
AlmaLinux:8python3-libxml22.9.7-15.el8_7.1ALSA-2023:0173
AlmaLinux:9python3-libxml22.9.13-3.el9_1ALSA-2023:0338
Alpine:v3.20libxml22.10.3-r0ALPINE-CVE-2022-40304
Alpine:v3.21libxml22.10.3-r0ALPINE-CVE-2022-40304
Alpine:v3.22libxml22.10.3-r0ALPINE-CVE-2022-40304
Alpine:v3.23libxml22.10.3-r0ALPINE-CVE-2022-40304
Alpine:v3.24libxml22.10.3-r0ALPINE-CVE-2022-40304
Debian:12libxml22.9.14+dfsg-1.1DEBIAN-CVE-2022-40304
Debian:13libxml22.9.14+dfsg-1.1DEBIAN-CVE-2022-40304
Debian:14libxml22.9.14+dfsg-1.1DEBIAN-CVE-2022-40304
Rocky Linux:8libxml20:2.9.7-15.el8_7.1RLSA-2023:0173
Rocky Linux:9libxml20:2.9.13-3.el9_1RLSA-2023:0338
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.2USN-5760-1
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.2UBUNTU-CVE-2022-40304

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-415 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References