CVE-2022-40303

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The outputcan be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

A flaw was found in libxml2. Parsing a XML document with the XML_PARSE_HUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation.(CVE-2022-40303)

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free.(CVE-2022-40304)

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

A flaw was found in libxml2. Parsing a XML document with the XML_PARSE_HUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation.(CVE-2022-40303)

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free.(CVE-2022-40304)

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.(CVE-2022-23308)

A flaw was found in libxml2. Parsing a XML document with the XML_PARSE_HUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation.(CVE-2022-40303)

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free.(CVE-2022-40304)

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: integer overflows with XML_PARSE_HUGE (CVE-2022-40303)

• libxml2: dict corruption caused by entity reference cycles (CVE-2022-40304)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: integer overflows with XML_PARSE_HUGE (CVE-2022-40303)

• libxml2: dict corruption caused by entity reference cycles (CVE-2022-40304)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: integer overflows with XML_PARSE_HUGE (CVE-2022-40303)
• libxml2: dict corruption caused by entity reference cycles (CVE-2022-40304)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: integer overflows with XML_PARSE_HUGE (CVE-2022-40303)
• libxml2: dict corruption caused by entity reference cycles (CVE-2022-40304)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: Integer overflows with XML_PARSE_HUGE
  • debian/patches/CVE-2022-40303.patch: Impose size limits when XML_PARSE_HUGE is set and add length checks to core parser functions
  • CVE-2022-40303
• SECURITY UPDATE: Dict corruption caused by entity reference cycles
  • debian/patches/CVE-2022-40304.patch: Stop storing entity content, orig, ExternalID and SystemID in a dict since these values are unlikely to occur multiple times in a document, so they shouldn't have been stored in a dict in the first place
  • CVE-2022-40304

• CVE-2022-40303: fix integer overflows with XML_PARSE_HUGE
• CVE-2022-40304: fix dict corruption caused by entity reference cycles

• CVE-2022-40303: fix integer overflows with XML_PARSE_HUGE
• CVE-2022-40304: fix dict corruption caused by entity reference cycles

• CVE-2022-40303: fix integer overflows with XML_PARSE_HUGE
• CVE-2022-40304: fix dict corruption caused by entity reference cycles

• CVE-2022-40303: fix integer overflows with XML_PARSE_HUGE
• CVE-2022-40304: fix dict corruption caused by entity reference cycles

• CVE-2021-3517: fix flaw in the xml entity encoding
• CVE-2021-3518: fix dangling pointers in entity reference nodes
• CVE-2022-23308: fix use-after-free of ID and IDREF attributes
• CVE-2022-40303: fix integer counters overflow when parsing a multi-gigabyte XML
• CVE-2022-40304: fix double free as a result of an invalid XML entity
• fix testapi.c to avoid false positive test errors
• fix a parser and fix a null pointer dereference

Integer overflows with XML_PARSE_HUGE. (CVE-2022-40303) Dict corruption caused by entity reference cycles. (CVE-2022-40304)

These are all security issues fixed in the libxml2-2-2.10.3-1.1 package on the GA media of openSUSE Tumbleweed.

In multiple functions of parser.c, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

This update for libxml2 fixes the following issues:

• CVE-2022-40303: Fixed integer overflows with XML_PARSE_HUGE (bsc#1204366).
• CVE-2022-40304: Fixed dict corruption caused by entity reference cycles (bsc#1204367).

This update for libxml2 fixes the following issues:

• CVE-2016-3709: Fixed possible XSS vulnerability (bsc#1201978).
• CVE-2022-40303: Fixed integer overflows with XML_PARSE_HUGE (bsc#1204366).
• CVE-2022-40304: Fixed dict corruption caused by entity reference cycles (bsc#1204367).

This update for libxml2 fixes the following issues:

• CVE-2016-3709: Fixed possible XSS vulnerability (bsc#1201978).
• CVE-2022-40303: Fixed integer overflows with XML_PARSE_HUGE (bsc#1204366).
• CVE-2022-40304: Fixed dict corruption caused by entity reference cycles (bsc#1204367).

It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to cause a crash. (CVE-2022-2309)

It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information or cause a crash. (CVE-2022-40303)

It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2022-40304)

USN-5760-1 fixed vulnerabilities in libxml2. This update provides the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information or cause a crash. (CVE-2022-40303)

It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2022-40304)

It was discovered Nokogiri did not correctly parse XML Schemas. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-26247)

Agustin Gianni discovered that Nokogiri did not correctly parse XML and HTML files. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or leak sensitive information. (CVE-2022-29181)