What’s Vulnerable › Vulnerabilities

CVE-2022-23308

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-26 · updated 2026-10-14
• Weakness: CWE-416

Description

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Affected products

• Apple iPadOS: before 15.5 — fixed in 15.5
• Apple Iphone Os: before 15.5 — fixed in 15.5
• macOS: from 10.15.0 before 10.15.7; 10.15.7, 10.15.7-security_update_2020-001, 10.15.7-security_update_2021-001, 10.15.7-security_update_2021-002, 10.15.7-security_update_2021-003, 10.15.7-security_update_2021-004 (+6) — fixed in 10.15.7
• Apple macOS: from 11.6.0 before 11.6.6; from 12.0 before 12.4 — fixed in 11.6.6, 12.4
• Apple tvOS: before 15.5 — fixed in 15.5
• Apple watchOS: before 8.6 — fixed in 8.6
• Debian Linux: 9.0
• Fedoraproject Fedora: 34
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Bootstrap Os: all versions
• Clustered Data ONTAP: all versions
• NetApp Clustered Data Ontap Antivirus Connector: all versions
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Manageability Software Development Kit: all versions
• NetApp ONTAP Select Deploy administration utility: all versions
• NetApp Smi-S Provider: all versions
• NetApp Snapdrive: all versions
• SnapManager for Oracle: all versions
• NetApp Solidfire, Enterprise Sds & Hci Storage Node: all versions
• NetApp Solidfire & Hci Management Node: all versions
• Oracle Communications Cloud Native Core Binding Support Function: 22.2.0
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 22.1.0
• Oracle Communications Cloud Native Core Network Repository Function: 22.1.2, 22.2.0

How to fix

Upgrade to a fixed version: Apple iPadOS 15.5; Apple Iphone Os 15.5; macOS 10.15.7; Apple macOS 11.6.6, 12.4; Apple tvOS 15.5; Apple watchOS 8.6; xmlsoft libxml2 2.9.13. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2022/May/33
• http://seclists.org/fulldisclosure/2022/May/34
• http://seclists.org/fulldisclosure/2022/May/35
• http://seclists.org/fulldisclosure/2022/May/36
• http://seclists.org/fulldisclosure/2022/May/37
• http://seclists.org/fulldisclosure/2022/May/38
• https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e
• https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS
• https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/
• https://security.gentoo.org/glsa/202210-03
• https://security.netapp.com/advisory/ntap-20220331-0008/

Get alerted when CVE-2022-23308 or the next vulnerability affects your stack