Orta CVSS 6.5 PoC var

CVE-2022-29824: Libxml2: tamsayı taşması

Yayın: 3 Mayıs 2022 06:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Özet bilgiler

Ürün: Xmlsoft Libxml2
CVSS v3.1: 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: %3,75 (yüzdelik 90)
CWE: CWE-190
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
xmlsoft-libxml2	—	—	2.9.14
xmlsoft-libxslt	—	1.1.35	—
fedoraproject-fedora	34	34	—
fedoraproject-fedora	35	35	—
fedoraproject-fedora	36	36	—
debian-debian-linux	9.0	9.0	—
debian-debian-linux	10.0	10.0	—
debian-debian-linux	11.0	11.0	—
netapp-active-iq-unified-manager	—	—	—
netapp-clustered-data-ontap	—	—	—
netapp-clustered-data-ontap-antivirus-connector	—	—	—
netapp-manageability-software-development-kit	—	—	—
netapp-ontap-select-deploy-administration-utility	—	—	—
netapp-smi-s-provider	—	—	—
netapp-snapdrive	—	—	—
netapp-snapmanager	—	—	—
netapp-solidfire-hci-management-node	—	—	—
oracle-zfs-storage-appliance-kit	8.8	8.8	—
netapp-h300s-firmware	—	—	—
netapp-h500s-firmware	—	—	—
netapp-h700s-firmware	—	—	—
netapp-h410s-firmware	—	—	—
netapp-h410c-firmware	—	—	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları