CVE-2022-29824

CVSS v3.1 6.5 (Medium)

CVSS v2.0 4.3 (Medium)

EPSS 0.15 % (52^th)

Affected Products 24

Advisories 20

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Weaknesses

CWE-190: Integer Overflow or Wraparound

CVE Status: PUBLISHED
CNA: MITRE
Published Date: 2022-05-03 03:15:06
(2 years ago)
Updated Date: 2023-11-07 03:46:05
(10 months ago)

Affected Products

Debian

Debian Linux

Fedoraproject

Fedora

Netapp

Oracle

Zfs Storage Appliance Kit

Xmlsoft

Configuration #1

		CPE23	From	Up To
	Xmlsoft Libxml2 prior 2.9.14 version	cpe:2.3:a:xmlsoft:libxml2		< 2.9.14
	Xmlsoft Libxslt 1.1.35 and prior versions	cpe:2.3:a:xmlsoft:libxslt		<= 1.1.35

Configuration #2

		CPE23	From	Up To
	Fedoraproject Fedora 34	cpe:2.3:o:fedoraproject:fedora:34
	Fedoraproject Fedora 35	cpe:2.3:o:fedoraproject:fedora:35
	Fedoraproject Fedora 36	cpe:2.3:o:fedoraproject:fedora:36

Configuration #3

		CPE23	From	Up To
	Debian Linux 9.0	cpe:2.3:o:debian:debian_linux:9.0
	Debian Linux 10.0	cpe:2.3:o:debian:debian_linux:10.0
	Debian Linux 11.0	cpe:2.3:o:debian:debian_linux:11.0

Configuration #4

		CPE23	From	Up To
	Netapp Active Iq Unified Manager for Vsphere	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vsphere
	Netapp Clustered Data Ontap	cpe:2.3:a:netapp:clustered_data_ontap:-
	Netapp Clustered Data Ontap Antivirus Connector	cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-
	Netapp Manageability Software Development Kit	cpe:2.3:a:netapp:manageability_software_development_kit:-
	Netapp Ontap Select Deploy Administration Utility	cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-
	Netapp Smi-s Provider	cpe:2.3:a:netapp:smi-s_provider:-
	Netapp Snapdrive for Unix	cpe:2.3:a:netapp:snapdrive:-:::::unix
	Netapp Snapmanager for Hyper-v	cpe:2.3:a:netapp:snapmanager:-:::::hyper-v
	Netapp Solidfire & Hci Management Node	cpe:2.3:a:netapp:solidfire_\%26_hci_management_node:-

Configuration #5

		CPE23	From	Up To
	Oracle Zfs Storage Appliance Kit 8.8	cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8

Configuration #6

AND

		CPE23
OR
	Netapp H300s Firmware	cpe:2.3:o:netapp:h300s_firmware:-
OR
	Running on/with
	Netapp H300s	cpe:2.3:h:netapp:h300s:-

Configuration #7

AND

		CPE23
OR
	Netapp H500s Firmware	cpe:2.3:o:netapp:h500s_firmware:-
OR
	Running on/with
	Netapp H500s	cpe:2.3:h:netapp:h500s:-

Configuration #8

AND

		CPE23
OR
	Netapp H700s Firmware	cpe:2.3:o:netapp:h700s_firmware:-
OR
	Running on/with
	Netapp H700s	cpe:2.3:h:netapp:h700s:-

Configuration #9

AND

		CPE23
OR
	Netapp H410s Firmware	cpe:2.3:o:netapp:h410s_firmware:-
OR
	Running on/with
	Netapp H410s	cpe:2.3:h:netapp:h410s:-

Configuration #10

AND

		CPE23
OR
	Netapp H410c Firmware	cpe:2.3:o:netapp:h410c_firmware:-
OR
	Running on/with
	Netapp H410c	cpe:2.3:h:netapp:h410c:-