CVE-2022-23308

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.(CVE-2019-19956)

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.(CVE-2022-23308)

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.(CVE-2022-23308)

A flaw was found in libxml2. Parsing a XML document with the XML_PARSE_HUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation.(CVE-2022-40303)

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free.(CVE-2022-40304)

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: Use-after-free of ID and IDREF attributes (CVE-2022-23308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: Use-after-free of ID and IDREF attributes (CVE-2022-23308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: Use-after-free of ID and IDREF attributes
  • debian/patches/CVE-2022-23308.patch: Do not store empty or whitespace-only attributes in ID table
  • CVE-2022-23308

• CVE-2022-23308: fix use-after-free of ID and IDREF attributes

• CVE-2022-23308: fix use-after-free of ID and IDREF attributes

• CVE-2022-23308: fix use-after-free of ID and IDREF attributes

• CVE-2022-23308: fix use-after-free of ID and IDREF attributes

• CVE-2021-3517: fix flaw in the xml entity encoding
• CVE-2021-3518: fix dangling pointers in entity reference nodes
• CVE-2022-23308: fix use-after-free of ID and IDREF attributes
• CVE-2022-40303: fix integer counters overflow when parsing a multi-gigabyte XML
• CVE-2022-40304: fix double free as a result of an invalid XML entity
• fix testapi.c to avoid false positive test errors
• fix a parser and fix a null pointer dereference

• CVE-2022-23308-fix.patch: fix undefined reference to ID variable and apply upstream regression fix to CVE-2022-23308 patch

• CVE-2025-7425: clear the attribute type through the live attr argument in xmlRemoveID() instead of id->attr, which read the xmlID already freed by xmlHashRemoveEntry()
• CVE-2022-23308: normalize the ID value in xmlRemoveID() after it is read from the attribute instead of before, where the pointer was uninitialized

• CVE-2025-7425: clear the attribute type through the live attr argument in xmlRemoveID() instead of id->attr, which read the xmlID already freed by xmlHashRemoveEntry()
• CVE-2022-23308: normalize the ID value in xmlRemoveID() after it is read from the attribute instead of before, where the pointer was uninitialized

• CVE-2025-7425: clear the attribute type through the live attr argument in xmlRemoveID() instead of id->attr, which read the xmlID already freed by xmlHashRemoveEntry()
• CVE-2022-23308: normalize the ID value in xmlRemoveID() after it is read from the attribute instead of before, where the pointer was uninitialized

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. (CVE-2022-23308)

This update for python-libxml2-python fixes the following issues:

• CVE-2022-23308: Fixed a use-after-free of ID and IDREF attributes (bsc#1196490).

These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libxml2-2-2.9.13-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.

This update for python-libxml2-python fixes the following issues:

• CVE-2022-23308: Fixed a use-after-free of ID and IDREF attributes (bsc#1196490).

This update for python-libxml2-python fixes the following issues:

• CVE-2022-23308: Fixed a use-after-free of ID and IDREF attributes (bsc#1196490).

This update for libxml2 fixes the following issues:

• CVE-2022-23308: Fixed use-after-free of ID and IDREF attributes. (bsc#1196490)

This update for libxml2 fixes the following issues:

• CVE-2022-23308: Fixed a use-after-free of ID and IDREF attributes (bsc#1196490).

This update for libxml2 fixes the following issues:

• CVE-2022-23308: Fixed a use-after-free of ID and IDREF attributes (bsc#1196490).
• CVE-2022-29824: Fixed integer overflow that could have led to an out-of-bounds write in buf.c (xmlBuf*) and tree.c (xmlBuffer*) (bsc#1199132).

This update for libxml2 fixes the following issues:

Update to 2.9.14:

• CVE-2022-29824: Fixed integer overflow that could have led to an out-of-bounds write in buf.c (xmlBuf*) and tree.c (xmlBuffer*) (bsc#1199132).

Update to version 2.9.13:

• CVE-2022-23308: Fixed a use-after-free of ID and IDREF attributes. (bsc#1196490)

It was discovered that libxml2 incorrectly handled certain XML files. An attacker could use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code.

Shinji Sato discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, and Ubuntu 16.04 ESM. (CVE-2022-23308)

It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-29824)