CVE-2022-40304: Double Free
A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free.
Other sources
Accessibility. A logic issue was addressed with improved restrictions.
— Apple
Accounts. This issue was addressed with improved data protection.
— Apple
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.
AppleAVD. An out-of-bounds write issue was addressed with improved input validation.
— Apple
AppleMobileFileIntegrity. This issue was addressed by enabling hardened runtime.
— Apple
Credit
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2022-42865
- CVE-2022-42821
- CVE-2022-32942
- CVE-2022-42864
- CVE-2022-46689
- CVE-2022-42845
- CVE-2022-42842
- CVE-2022-40303
- CVE-2022-40304
- CVE-2022-46704
- CVE-2022-42840
- CVE-2022-46718
- CVE-2022-42841
- CVE-2022-42843
- CVE-2022-46694
- CVE-2022-42848
- CVE-2022-46693
- CVE-2022-42851
- CVE-2022-46690
- CVE-2022-42837
- CVE-2022-46701
- CVE-2022-48618
- CVE-2022-42855
- CVE-2022-46695
- CVE-2022-42849
- CVE-2022-42866
- CVE-2022-46705
- CVE-2022-42867
- CVE-2022-46691
- CVE-2022-46692
- CVE-2022-42852
- CVE-2022-46696
- CVE-2022-46700
- CVE-2022-46698
- CVE-2022-46699
- CVE-2022-42863
- CVE-2022-42856
- CVE-2022-46717
- CVE-2022-42859
- CVE-2022-46703
- CVE-2022-42854
- CVE-2022-42853
- CVE-2022-42861
- CVE-2022-43454
- CVE-2022-48610
- CVE-2022-42846
- CVE-2023-23496
Frequently Asked Questions
What is the vulnerability ID for this issue in libxml2?
The vulnerability ID for this issue in libxml2 is CVE-2022-40304.
What is the severity of CVE-2022-40304?
The severity of CVE-2022-40304 is high.
What is the affected software of CVE-2022-40304?
The affected software of CVE-2022-40304 includes Apple iOS, Apple iPadOS, Apple macOS Monterey, Apple macOS Big Sur, Apple macOS Ventura, Apple watchOS, Apple tvOS, and Red Hat libxml2.
How can I fix CVE-2022-40304 in Apple iOS, iPadOS, and watchOS?
To fix CVE-2022-40304 in Apple iOS, iPadOS, and watchOS, update to version 15.7.2 or later for iOS, version 16.1.1 or later for iOS, and version 9.2 or later for watchOS.
How can I fix CVE-2022-40304 in Apple macOS Monterey, macOS Big Sur, and macOS Ventura?
To fix CVE-2022-40304 in Apple macOS Monterey, macOS Big Sur, and macOS Ventura, update to version 12.6.2 or later for macOS Monterey, version 11.7.2 or later for macOS Big Sur, and version 13.0.1 or later for macOS Ventura.