CVE-2022-29824

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Affected products

Alt Linux, Astra Linux, Centos, Ibm Aix, Linuxmint, Red Hat, Red Os, Rocky Linux

Xmlsoft libxml2

< 2.9.14

Xmlsoft Libxslt

≤ 1.1.35

Fix

Available

CVSS 3.1

6.5 MEDIUM

EPSS

3.7% (89th percentile)

Weakness

CWE-190

NVD status

Modified

Published

2022-05-03