CVE-2022-29824

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29824.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/gnome/libxml2

Affected ranges

Type

GIT

Repo

https://github.com/gnome/libxml2

Events

Introduced

Fixed

7846b0a677f8d3ce72486125fa281e92ac9970e8

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.9.14"
        }
    ],
    "cpe": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*"
}

Type

GIT

Repo

https://gitlab.gnome.org/gnome/libxml2

Events

Introduced

4b637079f26d8f5879ed45eb18cd249cad261951

Fixed

7846b0a677f8d3ce72486125fa281e92ac9970e8

Database specific

{
    "source": "DESCRIPTION",
    "extracted_events": [
        {
            "introduced": "libxml2"
        },
        {
            "fixed": "2.9.14"
        }
    ]
}

Type

GIT

Repo

https://gitlab.gnome.org/gnome/libxslt

Events

Introduced

Fixed

50af4e65da712ceb59f98a7feeeab2ddc3324ab9

Database specific

{
    "source": [
        "DESCRIPTION",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.35"
        },
        {
            "last_affected": "1.1.35"
        }
    ]
}

Affected versions

1.*

1.1.23

1.1.24

Other

CVE-2013-2877

CVE-2014-0191

CVE-2014-3660

CVE-2015-1819

CVE-2015-5312

CVE-2015-7497

CVE-2015-7498

CVE-2015-7499-1

CVE-2015-7499-2

CVE-2015-7500

CVE-2015-7941_1

CVE-2015-7941_2

CVE-2015-7942

CVE-2015-7942-2

CVE-2015-7995

CVE-2015-8035

CVE-2015-8242

CVE-2015-8317

CVE-2016-1762

CVE-2016-1833

CVE-2016-1834

CVE-2016-1835

CVE-2016-1836

CVE-2016-1837

CVE-2016-1838

CVE-2016-1839

CVE-2016-1840

CVE-2016-3627

CVE-2016-3705

CVE-2016-4449

CVE-2016-4483

CVE-2021-3541

EAZEL-NAUTILUS-MS-AUG07

FOR_GNOME_0_99_1

GNOME_0_30

GNOME_PRINT_0_24

GNUMERIC_FIRST_PUBLIC_RELEASE

LIBXML2_2_4_21

LIBXML2_2_5_0

LIBXML2_2_5_10

LIBXML2_2_5_7

LIBXML2_2_5_8

LIBXML2_2_5_9

LIBXML2_2_5_x

LIBXML2_2_6_1

LIBXML2_2_6_11

LIBXML2_2_6_12

LIBXML2_2_6_13

LIBXML2_2_6_14

LIBXML2_2_6_15

LIBXML2_2_6_16

LIBXML2_2_6_18

LIBXML2_2_6_19

LIBXML2_2_6_2

LIBXML2_2_6_20

LIBXML2_2_6_21

LIBXML2_2_6_22

LIBXML2_2_6_23

LIBXML2_2_6_24

LIBXML2_2_6_26

LIBXML2_2_6_27

LIBXML2_2_6_28

LIBXML2_2_6_3

LIBXML2_2_6_4

LIBXML2_2_6_5

LIBXML2_2_6_6

LIBXML2_2_6_7

LIBXML2_2_6_8

LIBXML2_2_6_9

LIBXML2_6_0

LIBXML_0_99

LIBXML_1_5_0

LIBXML_1_8_5

LIBXML_1_8_6

LIBXML_2_0_0

LIBXML_2_1_0

LIBXML_2_1_1

LIBXML_2_2_1

LIBXML_2_2_3

LIBXML_2_2_4

LIBXML_2_2_6

LIBXML_2_2_7

LIBXML_2_2_8

LIBXML_2_3_0

LIBXML_2_3_10

LIBXML_2_3_11

LIBXML_2_3_12

LIBXML_2_3_13

LIBXML_2_3_14

LIBXML_2_3_2

LIBXML_2_3_3

LIBXML_2_3_4

LIBXML_2_3_5

LIBXML_2_3_6

LIBXML_2_3_7

LIBXML_2_3_8

LIBXML_2_3_9

LIBXML_2_4_0

LIBXML_2_4_11

LIBXML_2_4_12

LIBXML_2_4_13

LIBXML_2_4_14

LIBXML_2_4_16

LIBXML_2_4_18

LIBXML_2_4_2

LIBXML_2_4_20

LIBXML_2_4_22

LIBXML_2_4_23

LIBXML_2_4_24

LIBXML_2_4_25

LIBXML_2_4_26

LIBXML_2_4_27

LIBXML_2_4_29

LIBXML_2_4_3

LIBXML_2_4_30

LIBXML_2_4_4

LIBXML_2_4_6

LIBXML_2_4_7

LIBXML_2_5_1

LIBXML_2_5_2

LIBXML_2_5_3

LIBXML_2_5_4

LIBXML_2_5_5

LIBXML_2_5_6

LIBXML_2_6_10

LIBXML_TEST_2_0_0

LIBXSLT_0_0_0

LIBXSLT_0_10_0

LIBXSLT_0_11_0

LIBXSLT_0_12_0

LIBXSLT_0_13_0

LIBXSLT_0_14_0

LIBXSLT_0_1_0

LIBXSLT_0_3_0

LIBXSLT_0_4_0

LIBXSLT_0_6_0

LIBXSLT_0_7_0

LIBXSLT_0_8_0

LIBXSLT_0_9_0

LIBXSLT_1_0_0

LIBXSLT_1_0_10

LIBXSLT_1_0_11

LIBXSLT_1_0_12

LIBXSLT_1_0_13

LIBXSLT_1_0_14

LIBXSLT_1_0_16

LIBXSLT_1_0_17

LIBXSLT_1_0_18

LIBXSLT_1_0_19

LIBXSLT_1_0_2

LIBXSLT_1_0_20

LIBXSLT_1_0_21

LIBXSLT_1_0_22

LIBXSLT_1_0_23

LIBXSLT_1_0_24

LIBXSLT_1_0_25

LIBXSLT_1_0_26

LIBXSLT_1_0_27

LIBXSLT_1_0_28

LIBXSLT_1_0_29

LIBXSLT_1_0_3

LIBXSLT_1_0_30

LIBXSLT_1_0_31

LIBXSLT_1_0_32

LIBXSLT_1_0_33

LIBXSLT_1_0_4

LIBXSLT_1_0_5

LIBXSLT_1_0_6

LIBXSLT_1_0_7

LIBXSLT_1_0_8

LIBXSLT_1_0_9

LIBXSLT_1_1_0

LIBXSLT_1_1_1

LIBXSLT_1_1_10

LIBXSLT_1_1_11

LIBXSLT_1_1_12

LIBXSLT_1_1_13

LIBXSLT_1_1_14

LIBXSLT_1_1_15

LIBXSLT_1_1_16

LIBXSLT_1_1_17

LIBXSLT_1_1_18

LIBXSLT_1_1_2

LIBXSLT_1_1_21

LIBXSLT_1_1_22

LIBXSLT_1_1_3

LIBXSLT_1_1_4

LIBXSLT_1_1_5

LIBXSLT_1_1_6

LIBXSLT_1_1_7

LIBXSLT_1_1_8

LIBXSLT_1_1_9

LIB_XML_1_1

LIB_XML_1_3

LIB_XML_1_4

LIB_XML_1_6_1

LIB_XML_1_6_2

LIB_XML_1_7_0

LIB_XML_1_7_1

LIB_XML_1_7_3

LIB_XML_1_8_3

LIB_XML_1_X

LIXSLT_0_5_0

PRE_MUCKUP

PRE_MUCKUP2

PRE_MUCKUP3

help

LIBXML2.*

LIBXML2.6.32

LIBXML2.7.0

LIBXML2.7.1

LIBXML2.7.2

LIBXML2.7.3

v1.*

v1.1.25

v1.1.26

v1.1.27

v1.1.27-rc1

v1.1.28

v1.1.29

v1.1.29-rc1

v1.1.29-rc2

v1.1.30

v1.1.30-rc1

v1.1.30-rc2

v1.1.31

v1.1.31-rc1

v1.1.31-rc2

v1.1.32

v1.1.32-rc1

v1.1.32-rc2

v1.1.33

v1.1.33-rc1

v1.1.33-rc2

v1.1.34

v1.1.34-rc2

v2.*

v2.7.4

v2.7.5

v2.7.6

v2.7.7

v2.7.8

v2.8.0

v2.8.0-rc1

v2.8.0-rc2

v2.9.0

v2.9.0-rc2

v2.9.1

v2.9.10

v2.9.10-rc1

v2.9.11

v2.9.12

v2.9.13

v2.9.2

v2.9.2-rc1

v2.9.2-rc2

v2.9.3

v2.9.4

v2.9.4-rc1

v2.9.4-rc2

v2.9.5

v2.9.5-rc1

v2.9.5-rc2

v2.9.6

v2.9.6-rc1

v2.9.7

v2.9.7-rc1

v2.9.8

v2.9.8-rc1

v2.9.9

v2.9.9-rc1

v2.9.9-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29824.json"