CVE-2022-23308
HIGH
7.5
CVSS Score
Published: February 26, 2022 at 12:00 AM UTC
Updated: October 14, 2026 at 04:17 PM UTC
35 products affected across 7 vendorsmacOSDebian LinuxFedora· also runs on 9 platforms
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 5%
SSVC
No known exploit
Description
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 15.5
Affected range stops below 15.5, so it looks safe — our inference, not a vendor statement
v < 15.5
Affected range stops below 15.5, so it looks safe — our inference, not a vendor statement
10.15.0 ≤ v < 10.15.711.6.0 ≤ v < 11.6.612.0 ≤ v < 12.410.15.710.15.7 security_update_2020-00110.15.7 security_update_2021-00110.15.7 security_update_2021-00210.15.7 security_update_2021-00310.15.7 security_update_2021-00410.15.7 security_update_2021-00510.15.7 security_update_2021-00610.15.7 security_update_2021-00710.15.7 security_update_2021-00810.15.7 security_update_2022-00110.15.7 security_update_2022-003
Affected range stops below 10.15.7, so it looks safe — our inference, not a vendor statement
Affected range stops below 11.6.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 12.4, so it looks safe — our inference, not a vendor statement
v < 15.5
Affected range stops below 15.5, so it looks safe — our inference, not a vendor statement
v < 8.6
Affected range stops below 8.6, so it looks safe — our inference, not a vendor statement
Debian Linux· Debiandrupal
95%95%
All versions
All versions
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/
- https://security.gentoo.org/glsa/202210-03
- https://www.oracle.com/security-alerts/cpujul2022.html
References (22)
Mailing ListThird Party Advisory
Source: [email protected]
http://seclists.org/fulldisclosure/2022/May/33Mailing ListThird Party Advisory
Source: [email protected]
http://seclists.org/fulldisclosure/2022/May/34Mailing ListThird Party Advisory
Source: [email protected]
http://seclists.org/fulldisclosure/2022/May/35Mailing ListThird Party Advisory
Source: [email protected]
http://seclists.org/fulldisclosure/2022/May/36Mailing ListThird Party Advisory
Source: [email protected]
http://seclists.org/fulldisclosure/2022/May/37Mailing ListThird Party Advisory
Source: [email protected]
http://seclists.org/fulldisclosure/2022/May/38PatchThird Party Advisory
Source: [email protected]
https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340eRelease NotesThird Party Advisory
Source: [email protected]
https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWSSSVC — Action Prioritization
SSVCNo known exploitAutomatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
7.5HIGHCISA-ADP
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-416
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card