IM
IronMonkey Threat Research

CVE-2022-29824 MEDIUM

Published: 2022-05-03 | Last Modified: 2024-11-21 | Status: Modified

Description

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Additional Descriptions (1)

En libxml2 versiones anteriores a 2.9.14, varias funciones de manejo de búferes en buf.c (xmlBuf*) y tree.c (xmlBuffer*) no comprueban los desbordamientos de enteros. Esto puede resultar en escrituras de memoria fuera de límites. La explotación requiere que la víctima abra un archivo XML diseñado de varios gigabytes. Otro software usando las funciones de búfer de libxml2, por ejemplo libxslt versiones hasta 1.1.35, también está afectado

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-190

Affected Products

Vendor Product Version Update Type
xmlsoft libxml2 * <built-in method update of dict object at 0x7fd2d825ba80> Application
xmlsoft libxslt * <built-in method update of dict object at 0x7fd2d825ae40> Application
fedoraproject fedora 34 <built-in method update of dict object at 0x7fd384a227c0> Operating System
fedoraproject fedora 35 <built-in method update of dict object at 0x7fd2db3f24c0> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd2d82598c0> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd2d825a7c0> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd39deeeb80> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd3842b5c80> Operating System
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd384639400> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd2d825b2c0> Application
netapp clustered_data_ontap_antivirus_connector - <built-in method update of dict object at 0x7fd3842b5840> Application
netapp manageability_software_development_kit - <built-in method update of dict object at 0x7fd384638640> Application
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd3842b5600> Application
netapp smi-s_provider - <built-in method update of dict object at 0x7fd36b263dc0> Application
netapp snapdrive - <built-in method update of dict object at 0x7fd384a67d00> Application
netapp snapmanager - <built-in method update of dict object at 0x7fd36b260a00> Application
netapp solidfire_\&_hci_management_node - <built-in method update of dict object at 0x7fd2d8259c00> Application
oracle zfs_storage_appliance_kit 8.8 <built-in method update of dict object at 0x7fd2d3998c00> Application
netapp h300s_firmware - <built-in method update of dict object at 0x7fd38426cc80> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd31b20f800> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd369632840> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd2d825af40> Operating System
netapp h410c_firmware - <built-in method update of dict object at 0x7fd36a702f40> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:unix:*:*
Yes cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*
Yes cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

References