Vulnerability · Published Oct 6, 2023 · Assigned by mitre
CVE-2023-45322
Medium 6.5
In plain English
A medium-severity security flaw in the libxml2 package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.0%top 38.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libxml2 | 2.9.14+dfsg-1.3~deb12u2 | DEBIAN-CVE-2023-45322 |
| Debian:12 | libxml2 | 2.9.14+dfsg-1.3~deb12u2 | DSA-5949-1 |
| Debian:13 | libxml2 | 2.12.7+dfsg+really2.9.14-1 | DEBIAN-CVE-2023-45322 |
| Debian:14 | libxml2 | 2.12.7+dfsg+really2.9.14-1 | DEBIAN-CVE-2023-45322 |
Affected products (as reported)
References
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/583
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/344
- [oss-security] 20231006 CVE-2023-45322: Use-after-free in libxml2 through 2.11.5 mailing-list
- https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html