CVE-2022-40304

CVSS V2 None CVSS V3 None
Description
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.
Overview
  • CVE ID
  • CVE-2022-40304
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-11-23T18:15:12
  • Last Modified Date
  • 2023-02-23T22:20:34
Weakness Enumerations
CWE URL
CWE-611 http://cwe.mitre.org/data/definitions/611.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* 1 OR 2.10.3
References
Reference URL Reference Tags
http://seclists.org/fulldisclosure/2022/Dec/21
http://seclists.org/fulldisclosure/2022/Dec/24
http://seclists.org/fulldisclosure/2022/Dec/25
http://seclists.org/fulldisclosure/2022/Dec/26
https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b Patch Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/tags Release Notes Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3 Patch Release Notes Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0003/
https://support.apple.com/kb/HT213531
https://support.apple.com/kb/HT213533
https://support.apple.com/kb/HT213534
https://support.apple.com/kb/HT213535
https://support.apple.com/kb/HT213536
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-40304
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304
History
Created Old Value New Value Data Type Notes
2022-11-23 19:00:16 Added to TrackCVE
2022-12-07 18:02:05 2022-11-23T18:15Z 2022-11-23T18:15:12 CVE Published Date updated
2022-12-07 18:02:05 2022-11-30T16:26:10 CVE Modified Date updated
2022-12-07 18:02:05 Analyzed Vulnerability Status updated
2022-12-07 18:02:05 CWE-611 Weakness Enumeration new
2022-12-07 18:02:07 CPE Information updated
2022-12-09 19:17:17 2022-12-09T19:15:13 CVE Modified Date updated
2022-12-09 19:17:17 Analyzed Modified Vulnerability Status updated
2022-12-09 19:17:18 References updated
2022-12-13 21:14:44 2022-12-13T20:15:10 CVE Modified Date updated
2022-12-13 21:14:46 References updated
2022-12-19 19:14:09 Modified Undergoing Analysis Vulnerability Status updated
2022-12-21 07:02:19 2022-12-21T06:15:10 CVE Modified Date updated
2022-12-21 07:02:20 References updated
2023-01-31 21:14:31 2023-01-31T20:14:03 CVE Modified Date updated
2023-01-31 21:14:31 Undergoing Analysis Analyzed Vulnerability Status updated
2023-02-23 23:15:50 2023-02-23T22:20:34 CVE Modified Date updated