CVE-2022-29824

Published: 3 May 2022

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Priority

Cvss 3 Severity Score

6.5

Score breakdown

Status

Package	Release	Status
libxml2 Launchpad, Ubuntu, Debian	bionic	Released (2.9.4+dfsg1-6.1ubuntu1.6)
	focal	Released (2.9.10+dfsg-5ubuntu0.20.04.3)
	impish	Released (2.9.12+dfsg-4ubuntu0.2)
	jammy	Released (2.9.13+dfsg-1ubuntu0.1)
	upstream	Released (2.9.14)
	Patches: upstream: https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab upstream: https://gitlab.gnome.org/GNOME/libxml2/-/commit/6c283d83eccd940bcde15634ac8c7f100e3caefd

Severity score breakdown

Parameter	Value
Base score	6.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010526

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›