Your submission was sent successfully! Close

CVE-2022-40303

Published: 23 November 2022

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
libxml2
Launchpad, Ubuntu, Debian
bionic Needed

focal Needed

jammy Needed

kinetic Needed

trusty Needed

upstream
Released (2.10.3)
xenial Needed

Patches:
upstream: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0