CVE-2023-45322

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

** DISPUTED ** libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."(CVE-2023-45322)

• CVE-2023-45322: fix use-after-free in xmlStaticCopyNodeList when copying DTDs
• CVE-2024-34459: fix buffer over-read in xmlHTMLPrintFileContext in xmllint
• CVE-2025-6170: fix potential buffer overflows in xmllint interactive shell
• CVE-2025-8732: fix stack overflow from self-referencing SGML CATALOG entries
• CVE-2026-0989: add RelaxNG include recursion limit
• CVE-2026-0990: prevent infinite recursion in xmlCatalogListXMLResolveURI
• CVE-2026-0992: ignore repeated nextCatalog entries in XML catalog parsing
• CVE-2026-1757: fix memory leak in xmllint interactive shell

• CVE-2023-29469: guard xmlDictComputeFastKey against namelen <= 0 to prevent out-of-bounds read when hashing zero-length or negative-length keys
• CVE-2023-45322: fix use-after-free in xmlNodeDumpOutputInternal triggered by malformed XML when default error handler interacts with freed memory
• CVE-2024-34459: bound the backwards trim in xmlHTMLPrintFileContext so it cannot overread the buffer when scanning for newline / carriage-return
• CVE-2025-9714: keep and restore XPath context depth across recursive xmlXPathRunEval invocations (EXSLT dyn:map / dyn:evaluate) to avoid stack overflow when the recursion limit was being reset prematurely

• CVE-2023-29469: guard xmlDictComputeFastKey against namelen <= 0 to prevent out-of-bounds read when hashing zero-length or negative-length keys
• CVE-2023-45322: fix use-after-free in xmlNodeDumpOutputInternal triggered by malformed XML when default error handler interacts with freed memory
• CVE-2024-34459: bound the backwards trim in xmlHTMLPrintFileContext so it cannot overread the buffer when scanning for newline / carriage-return
• CVE-2025-9714: keep and restore XPath context depth across recursive xmlXPathRunEval invocations (EXSLT dyn:map / dyn:evaluate) to avoid stack overflow when the recursion limit was being reset prematurely

• CVE-2023-29469: guard xmlDictComputeFastKey against namelen <= 0 to prevent out-of-bounds read when hashing zero-length or negative-length keys
• CVE-2023-45322: fix use-after-free in xmlNodeDumpOutputInternal triggered by malformed XML when default error handler interacts with freed memory
• CVE-2024-34459: bound the backwards trim in xmlHTMLPrintFileContext so it cannot overread the buffer when scanning for newline / carriage-return
• CVE-2025-9714: keep and restore XPath context depth across recursive xmlXPathRunEval invocations (EXSLT dyn:map / dyn:evaluate) to avoid stack overflow when the recursion limit was being reset prematurely

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. (CVE-2023-45322)

These are all security issues fixed in the libxml2-2-2.11.5-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libxml2 fixes the following issues:

• CVE-2023-45322: Fixed a use-after-free in xmlUnlinkNode() in tree.c (bsc#1216129).

This update for libxml2 fixes the following issues:

• CVE-2023-45322: Fixed a use-after-free in xmlUnlinkNode() in tree.c (bsc#1216129).

This update for libxml2 fixes the following issues:

• CVE-2023-45322: Fixed a use-after-free in xmlUnlinkNode() in tree.c (bsc#1216129).

This update for libxml2 fixes the following issues:

• CVE-2023-45322: Fixed a use-after-free in xmlUnlinkNode() in tree.c (bsc#1216129).