CVE-2022-23308

libxml2: Use-after-free of ID and IDREF attributes

Published Feb 26, 2022 CVSS 3.1 · 7.5 High EPSS 5.1% KEV · Not listed
Description
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2972-1 libxml2 security update
EUVD EUVD EUVD-2022-28391 valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
Ubuntu USN Ubuntu USN USN-5324-1 libxml2 vulnerability
Ubuntu USN Ubuntu USN USN-5422-1 libxml2 vulnerabilities

Subscriptions

Apple Ipados Iphone Os Mac Os X Macos Tvos Watchos
Debian Debian Linux
Fedoraproject Fedora
Netapp Active Iq Unified Manager Bootstrap Os Clustered Data Ontap Clustered Data Ontap Antivirus Connector H300e H300e Firmware H300s H300s Firmware H410c H410c Firmware H410s H410s Firmware H500e H500e Firmware H500s H500s Firmware H700e H700e Firmware H700s H700s Firmware Hci Compute Node Manageability Software Development Kit Ontap Select Deploy Administration Utility Smi-s Provider Snapdrive Snapmanager Solidfire\, Enterprise Sds \& Hci Storage Node Solidfire \& Hci Management Node
Oracle Communications Cloud Native Core Binding Support Function Communications Cloud Native Core Network Function Cloud Native Environment Communications Cloud Native Core Network Repository Function Communications Cloud Native Core Network Slice Selection Function Communications Cloud Native Core Unified Data Repository Mysql Workbench Zfs Storage Appliance Kit
Redhat Enterprise Linux Jboss Core Services
Xmlsoft Libxml2
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Oct 14, 2026, 3:48 PM
Reserved
Jan 17, 2022, 12:00 AM
Status
Modified
Published
Feb 26, 2022, 5:15 AM
Modified
Oct 14, 2026, 4:17 PM
Severity
Moderate
Public date
Feb 20, 2022, 12:00 AM