IM
IronMonkey Threat Research

CVE-2022-40303 HIGH

Published: 2022-11-23 | Last Modified: 2025-04-29 | Status: Modified

Description

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Additional Descriptions (1)

Se descubrió un problema en libxml2 antes de la versión 2.10.3. Al analizar un documento XML de varios gigabytes con la opción de analizador XML_PARSE_HUGE habilitada, varios contadores de enteros pueden desbordarse. Esto da como resultado un intento de acceder a una matriz con un desplazamiento negativo de 2 GB, lo que normalmente provoca un error de segmentación.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en CWE-190
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-190

Affected Products

Vendor Product Version Update Type
xmlsoft libxml2 * <built-in method update of dict object at 0x7fd369d6da80> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd369d6f2c0> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd34bce1740> Application
netapp clustered_data_ontap_antivirus_connector - <built-in method update of dict object at 0x7fd369d6d440> Application
netapp netapp_manageability_sdk - <built-in method update of dict object at 0x7fd369d6c7c0> Application
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd369d6cd40> Application
netapp snapmanager - <built-in method update of dict object at 0x7fd36b157ec0> Application
apple ipados * <built-in method update of dict object at 0x7fd369d6ff80> Operating System
apple iphone_os * <built-in method update of dict object at 0x7fd369d6c940> Operating System
apple macos * <built-in method update of dict object at 0x7fd369d6cb40> Operating System
apple macos * <built-in method update of dict object at 0x7fd2d825bb40> Operating System
apple tvos * <built-in method update of dict object at 0x7fd369d6fd40> Operating System
apple watchos * <built-in method update of dict object at 0x7fd36b157100> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd369d6e580> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd369d6c180> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd36b157a80> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd369d6dc80> Operating System
netapp h410c_firmware - <built-in method update of dict object at 0x7fd369d6c480> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:netapp_manageability_sdk:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

References