search

Aakashmom / external_libxml2

Other
0 stars 0 forks source link

CVE-2022-29824 (Medium) detected in https://source.codeaurora.org/quic/la/platform/external/libxml2/10.00.00.561, https://source.codeaurora.org/quic/la/platform/external/libxml2/10.00.00.561 #11

Open mend-bolt-for-github[bot] opened 3 weeks ago

mend-bolt-for-github[bot] commented 3 weeks ago

CVE-2022-29824 - Medium Severity Vulnerability

Vulnerable Libraries - https://source.codeaurora.org/quic/la/platform/external/libxml2/10.00.00.561, https://source.codeaurora.org/quic/la/platform/external/libxml2/10.00.00.561

Vulnerability Details

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Publish Date: 2022-05-03

URL: CVE-2022-29824

CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824

Release Date: 2022-05-03

Fix Resolution: v2.9.14

Step up your Open Source Security Game with Mend here