Description
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Apple / iPadOS15.7.2
- Apple / iphone_os15.7.2
- Apple / macOS11.0 – 11.7.2
- Apple / tvOS16.2
- Apple / watchOS9.2
- NetApp / active_iq_unified_manager
- NetApp / Clustered Data ONTAP
- NetApp / clustered_data_ontap_antivirus_connector
- NetApp / h300s_firmware
- NetApp / h410c_firmware
- NetApp / h410s_firmware
- NetApp / h500s_firmware
- NetApp / h700s_firmware
- NetApp / manageability_software_development_kit
- NetApp / smi-s_provider
- NetApp / snapmanager
- xmlsoft / libxml22.10.3
References
- MISChttps://gitlab.gnome.org/GNOME/libxml2/-/tags
- MISChttps://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3
- MISChttps://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b
- MISChttps://security.netapp.com/advisory/ntap-20221209-0003/
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213534
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213533
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213531
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213536
- VENDOR_ADVISORYhttps://support.apple.com/kb/HT213535
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Dec/21
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Dec/25
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Dec/26
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Dec/24
- MAILING_LISThttp://seclists.org/fulldisclosure/2022/Dec/27
Updated 44m ago · 8 sources