CVE-2022-49043

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-49043
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49043.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-49043
Downstream
AZL (1)
CLSA (11)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
OESA (1)
RHSA (5)
RLSA (1)
SUSE (4)
UBUNTU (1)
Related
ALSA (2)
SUSE (4)
Published
2025-01-26T00:00:00Z
Modified
2026-10-22T07:13:39Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-416"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49043.json"
}
References

Affected packages

Git / gitlab.gnome.org/gnome/libxml2

Affected ranges

Type
GIT
Repo
https://gitlab.gnome.org/gnome/libxml2
Events
Introduced
5d211f4c7a150e45a301cec55426a7ed7edb7f50
Fixed
f296934ade688baab79caf1c62a82149ad78accf
Fixed
5a19e21605398cef6a8b1452477a8705cb41562b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "fixed":  "2.11.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "5a19e21605398cef6a8b1452477a8705cb41562b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
CVE-2013-2877
CVE-2014-0191
CVE-2014-3660
CVE-2015-1819
CVE-2015-5312
CVE-2015-7497
CVE-2015-7498
CVE-2015-7499-1
CVE-2015-7499-2
CVE-2015-7500
CVE-2015-7941_1
CVE-2015-7941_2
CVE-2015-7942
CVE-2015-7942-2
CVE-2015-8035
CVE-2015-8242
CVE-2015-8317
CVE-2016-1762
CVE-2016-1833
CVE-2016-1834
CVE-2016-1835
CVE-2016-1836
CVE-2016-1837
CVE-2016-1838
CVE-2016-1839
CVE-2016-1840
CVE-2016-3627
CVE-2016-3705
CVE-2016-4449
CVE-2016-4483
CVE-2021-3541
GNOME_PRINT_0_24
LIBXML2_2_4_21
LIBXML2_2_5_0
LIBXML2_2_5_10
LIBXML2_2_5_7
LIBXML2_2_5_8
LIBXML2_2_5_9
LIBXML2_2_5_x
LIBXML2_2_6_1
LIBXML2_2_6_11
LIBXML2_2_6_12
LIBXML2_2_6_13
LIBXML2_2_6_14
LIBXML2_2_6_15
LIBXML2_2_6_16
LIBXML2_2_6_18
LIBXML2_2_6_19
LIBXML2_2_6_2
LIBXML2_2_6_20
LIBXML2_2_6_21
LIBXML2_2_6_22
LIBXML2_2_6_23
LIBXML2_2_6_24
LIBXML2_2_6_26
LIBXML2_2_6_27
LIBXML2_2_6_28
LIBXML2_2_6_3
LIBXML2_2_6_4
LIBXML2_2_6_5
LIBXML2_2_6_6
LIBXML2_2_6_7
LIBXML2_2_6_8
LIBXML2_2_6_9
LIBXML2_6_0
LIBXML_2_0_0
LIBXML_2_1_0
LIBXML_2_1_1
LIBXML_2_2_1
LIBXML_2_2_3
LIBXML_2_2_4
LIBXML_2_2_6
LIBXML_2_2_7
LIBXML_2_2_8
LIBXML_2_3_0
LIBXML_2_3_10
LIBXML_2_3_11
LIBXML_2_3_12
LIBXML_2_3_13
LIBXML_2_3_14
LIBXML_2_3_2
LIBXML_2_3_3
LIBXML_2_3_4
LIBXML_2_3_5
LIBXML_2_3_6
LIBXML_2_3_7
LIBXML_2_3_8
LIBXML_2_3_9
LIBXML_2_4_0
LIBXML_2_4_11
LIBXML_2_4_12
LIBXML_2_4_13
LIBXML_2_4_14
LIBXML_2_4_16
LIBXML_2_4_18
LIBXML_2_4_2
LIBXML_2_4_20
LIBXML_2_4_22
LIBXML_2_4_23
LIBXML_2_4_24
LIBXML_2_4_25
LIBXML_2_4_26
LIBXML_2_4_27
LIBXML_2_4_29
LIBXML_2_4_3
LIBXML_2_4_30
LIBXML_2_4_4
LIBXML_2_4_6
LIBXML_2_4_7
LIBXML_2_5_1
LIBXML_2_5_2
LIBXML_2_5_3
LIBXML_2_5_4
LIBXML_2_5_5
LIBXML_2_5_6
LIBXML_2_6_10
LIBXML_TEST_2_0_0
PRE_MUCKUP
PRE_MUCKUP2
PRE_MUCKUP3
help
LIBXML2.*
LIBXML2.6.32
LIBXML2.7.0
LIBXML2.7.1
LIBXML2.7.2
LIBXML2.7.3
v2.*
v2.10.0
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.8.0
v2.8.0-rc1
v2.8.0-rc2
v2.9.0
v2.9.0-rc2
v2.9.1
v2.9.10
v2.9.10-rc1
v2.9.11
v2.9.12
v2.9.13
v2.9.2
v2.9.2-rc1
v2.9.2-rc2
v2.9.3
v2.9.4
v2.9.4-rc1
v2.9.4-rc2
v2.9.5
v2.9.5-rc1
v2.9.5-rc2
v2.9.6
v2.9.6-rc1
v2.9.7
v2.9.7-rc1
v2.9.8
v2.9.8-rc1
v2.9.9
v2.9.9-rc1
v2.9.9-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49043.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "234727746432330059379395021616092678607",
                "16179871270064240906158248971492029307",
                "159292601689154207518257892295593177007",
                "291328165747208326717008482495952795005",
                "266861528478367806157829654743814337325",
                "163347916687622542487864494211142632027",
                "248669120723773372404211044952287217859",
                "215996276487752814757516578671470546055",
                "267951245514243856224294851595258107199",
                "311872970062567964960244385447078116475",
                "195389415836806891286407055929463719000"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-49043-436ba84c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/libxml2@5a19e21605398cef6a8b1452477a8705cb41562b",
        "target":  {
            "file":  "xinclude.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "31088922347676708703698485657285354355",
            "length":  2890
        },
        "id":  "CVE-2022-49043-8c11fe6f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/libxml2@5a19e21605398cef6a8b1452477a8705cb41562b",
        "target":  {
            "file":  "xinclude.c",
            "function":  "xmlXIncludeAddNode"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T07:13:39Z"