Уязвимость CVE-2022-40303: Информация

Описание

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Важность: HIGH (7,5)

Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-40303

Опубликовано: 23 ноября 2022 г.

Изменено: 29 апреля 2025 г.

Идентификатор типа ошибки: CWE-190

Исправленные пакеты

Имя пакета	Ветка	Исправлено в версии	Версия в репозитории	Errata ID	№ Задания	Состояние
libxml2	sisyphus	2.10.3-alt1	2.12.10-alt2	ALT-PU-2022-2865-1	308392	Исправлено
libxml2	sisyphus_e2k	2.10.3-alt1	2.12.10-alt2	ALT-PU-2022-6670-1	-	Исправлено
libxml2	sisyphus_riscv64	2.10.3-alt1	2.12.10-alt2	ALT-PU-2022-6660-1	-	Исправлено
libxml2	p10	2.9.12-alt1.p10.1	2.9.12-alt1.p10.5	ALT-PU-2023-1172-1	314068	Исправлено
libxml2	p10_e2k	2.9.12-alt1.p10.1	2.9.12-alt1.p10.5	ALT-PU-2023-2426-1	-	Исправлено
libxml2	p9	2.9.10-alt6.p9.1	2.9.10-alt6.p9.1	ALT-PU-2023-1234-1	314487	Исправлено
libxml2	c10f2	2.9.12-alt1.p10.1	2.9.12-alt1.p10.6	ALT-PU-2023-1172-1	314068	Исправлено
libxml2	c9f2	2.9.12-alt1.c9f2.1	2.9.12-alt1.c9f2.6	ALT-PU-2022-3377-1	311279	Исправлено
libxml2	p11	2.10.3-alt1	2.12.10-alt2	ALT-PU-2022-2865-1	308392	Исправлено

Ссылки на рекомендации, решения и инструменты

Ссылка	Ресурс
http://seclists.org/fulldisclosure/2022/Dec/21	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/24	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/25	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/26	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/27
https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0	Patch Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3	Release Notes Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0003/	Third Party Advisory
https://support.apple.com/kb/HT213531	Third Party Advisory
https://support.apple.com/kb/HT213533	Third Party Advisory
https://support.apple.com/kb/HT213534	Third Party Advisory
https://support.apple.com/kb/HT213535	Third Party Advisory
https://support.apple.com/kb/HT213536	Third Party Advisory
BDU:2022-06701

Подверженные конфигурации:
1. cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
  End excluding
  2.10.3
  cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
  cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
  cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
  cpe:2.3:a:netapp:netapp_manageability_sdk:-:*:*:*:*:*:*:*
  cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
  cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*
  cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
  End excluding
  15.7.2
  cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
  End excluding
  15.7.2
  cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
  Start including
  11.0
  End excluding
  11.7.2
  cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
  Start including
  12.0
  End excluding
  12.6.2
  cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
  End excluding
  16.2
  cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
  End excluding
  9.2
  cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
  cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
  cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
  cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
  cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
  cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
  cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Версия: v25.10.0

Наверх