CVE-2022-23308: Use After Free

February 26, 2022 (updated November 7, 2023)

valid.c in libxml2 before 2.9.13, which is used by libxml2.vc140_xp has a use-after-free of ID and IDREF attributes.

References

github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e
gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS
nvd.nist.gov/vuln/detail/CVE-2022-23308

Code Behaviors & Features

Detect and mitigate CVE-2022-23308 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →