libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."
References
| Link | Resource |
|---|---|
| https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 | Issue Tracking Patch Vendor Advisory |
| https://gitlab.gnome.org/GNOME/libxml2/-/issues/344 | Issue Tracking Patch Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2023/10/06/5 | Mailing List Patch Third Party Advisory |
Configurations
History
07 Nov 2023, 04:21
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail." |
11 Oct 2023, 18:13
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-06 22:15
Updated : 2024-08-02 21:15
NVD link : CVE-2023-45322
Mitre link : CVE-2023-45322
JSON object : View
Products Affected
xmlsoft
- libxml2
CWE
CWE-416
Use After Free