Fluid Attacks Database

Description

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	libxml2	>=0 <2.12.7+dfsg+really2.9.14-1	2.12.7+dfsg+really2.9.14-1
debian 14	libxml2	>=0 <2.12.7+dfsg+really2.9.14-1	2.12.7+dfsg+really2.9.14-1
nuget	libxml2	<0	-
nuget	libxml2.vc140_xp.mt.static.x86	<0	-
debian 12	libxml2	=2.9.14+dfsg-1.2 \|\| =2.9.14+dfsg-1.3~deb12u1 \|\| >=0 <2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u2
debian 11	libxml2	=2.9.10+dfsg-6.7 \|\| =2.9.10+dfsg-6.7+deb11u1 \|\| =2.9.10+dfsg-6.7+deb11u2 \|\| =2.9.10+dfsg-6.7+deb11u3 \|\| =2.9.10+dfsg-6.7+deb11u4 \|\| =2.9.10+dfsg-6.7+deb11u5 \|\| >=0 <2.9.10+dfsg-6.7+deb11u6	2.9.10+dfsg-6.7+deb11u6
rubygems	nokogiri	<0	-
rpm rhel7	libxml2	-	-
rpm rhel8	libxml2	-	-
rpm rhel9	libxml2	-	-

1-10 of 11

Aliases

1. CVE-2023-453222. NVD-2023-453223. OSV-DEBIAN-2023-453224. OSV-2023-453225. GCVE-2023-453226. SECURITY-TRACKER-CVE-2023-45322

References

1. https://gitlab.gnome.org/GNOME/libxml2/-/issues/5832. https://gitlab.gnome.org/GNOME/libxml2/-/issues/3443. http://www.openwall.com/lists/oss-security/2023/10/06/5

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.