CVE-2022-40303
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
Risk Assessment
Processing a malicious, very large XML document can crash the application (denial of service).
Recommendation
Update libxml2 to version 2.10.3 or later and avoid parsing untrusted XML documents with the XML_PARSE_HUGE option.
Other vulnerabilities in libxml2
See all- CVE-2017-7013High
An issue was discovered in certain Apple products related to the 'libxml2' component. Affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, tvOS before 10.2.2, and watchOS before 3.2.3.
- CVE-2017-7010High
An issue was discovered in certain Apple products related to the 'libxml2' component. It affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2.
- CVE-2016-4483High
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.
- CVE-2016-4449High
CVE-2016-4449 describes an XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before version 2.9.4. This vulnerability, when not in validating mode, allows attackers to read arbitrary files or cause denial of service through unspecified vectors.
- CVE-2016-4447High
The xmlParseElementDecl function in libxml2 before version 2.9.4 allows context-dependent attackers to cause a denial of service via a crafted file, resulting in heap-based buffer underread and application crash.
- CVE-2016-1840High
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before version 2.9.4 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted XML document.
- CVE-2016-1835High
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before version 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.
- CVE-2016-1834High
Heap-based buffer overflow in the xmlStrncat function in libxml2 before version 2.9.4, used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
- CVE-2016-3705High
The xmlParserEntityCheck and xmlParseAttValueComplex functions in libxml2 2.9.3 do not properly keep track of the recursion depth, allowing context-dependent attackers to cause a denial of service via a crafted XML document containing a large number of nested entity references.
- CVE-2016-3627High
The xmlStringGetNodeList function in libxml2 version 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service through a crafted XML document, leading to infinite recursion, stack consumption, and application crash.
Original NVD description (English source)
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS