CVE-2022-40303: Integer Overflow
A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation.
Other sources
Accessibility. A logic issue was addressed with improved restrictions.
— Apple
Accounts. This issue was addressed with improved data protection.
— Apple
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
AppleAVD. An out-of-bounds write issue was addressed with improved input validation.
— Apple
AppleMobileFileIntegrity. This issue was addressed by enabling hardened runtime.
— Apple
Credit
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2022-42865
- CVE-2022-42821
- CVE-2022-32942
- CVE-2022-42864
- CVE-2022-46689
- CVE-2022-42845
- CVE-2022-42842
- CVE-2022-40303
- CVE-2022-40304
- CVE-2022-46704
- CVE-2022-42840
- CVE-2022-46718
- CVE-2022-42841
- CVE-2022-42843
- CVE-2022-46694
- CVE-2022-42848
- CVE-2022-46693
- CVE-2022-42851
- CVE-2022-46690
- CVE-2022-42837
- CVE-2022-46701
- CVE-2022-48618
- CVE-2022-42855
- CVE-2022-46695
- CVE-2022-42849
- CVE-2022-42866
- CVE-2022-46705
- CVE-2022-42867
- CVE-2022-46691
- CVE-2022-46692
- CVE-2022-42852
- CVE-2022-46696
- CVE-2022-46700
- CVE-2022-46698
- CVE-2022-46699
- CVE-2022-42863
- CVE-2022-42856
- CVE-2022-46717
- CVE-2022-42859
- CVE-2022-46703
- CVE-2022-42854
- CVE-2022-42853
- CVE-2022-42861
- CVE-2022-43454
- CVE-2022-48610
- CVE-2022-42846
- CVE-2023-23496
Frequently Asked Questions
What is CVE-2022-40303?
CVE-2022-40303 is a vulnerability in libxml2 that allows for integer overflow during parsing of large XML documents.
What is the severity of CVE-2022-40303?
CVE-2022-40303 has a severity level of high (7).
Which software and versions are affected by CVE-2022-40303?
Apple iOS and iPadOS versions up to and including 15.7.2, 16.1.1, watchOS up to and including 9.2, tvOS up to and including 16.2, macOS Monterey up to and including 12.6.2, macOS Big Sur up to and including 11.7.2, and macOS Ventura up to and including 13.0.1 are affected by CVE-2022-40303. Additionally, libxml2 package versions up to and including 2.10.3 for Apple iPadOS and versions up to and including 0:2.9.7-15.el8_7.1 and 0:2.9.13-3.el9_1 for redhat/libxml2 are also affected.
How can I fix CVE-2022-40303?
Upgrade to Apple iOS or iPadOS version 15.7.2 or later, or 16.1.1 or later. Upgrade to watchOS 9.2 or later, tvOS 16.2 or later, macOS Monterey 12.6.2 or later, macOS Big Sur 11.7.2 or later, or macOS Ventura 13.0.1 or later. For redhat/libxml2, upgrade to version 2.10.3 or later for Apple iPadOS, or version 0:2.9.7-15.el8_7.1 or 0:2.9.13-3.el9_1 or later for redhat/libxml2.
Where can I find more information about CVE-2022-40303?
You can find more information about CVE-2022-40303 at the following references: [Apple Support - HT213531](https://support.apple.com/en-us/HT213531), [Apple Support - HT213505](https://support.apple.com/en-us/HT213505), [Apple Support - HT213536](https://support.apple.com/en-us/HT213536).