NetSight
IP …
medium6.5

CVE-2022-29824

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows.

Impact

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Affected products

VendorProductAffected versions
XmlsoftLibxml2
before 2.9.14
XmlsoftLibxslt
through 1.1.35
FedoraprojectFedora
Versions 34, 35, 36
DebianDebian Linux
Versions 9.0, 10.0, 11.0
NetappActive Iq Unified Manager
All versions
NetappClustered Data Ontap
All versions
NetappClustered Data Ontap Antivirus Connector
All versions
NetappManageability Software Development Kit
All versions
NetappOntap Select Deploy Administration Utility
All versions
NetappSmi-S Provider
All versions
NetappSnapdrive
All versions
NetappSnapmanager
All versions

Weakness classification

CWE-190

References