Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 6 Oct 2023 15:04:27 -0700
From: Alan Coopersmith <>
Subject: CVE-2023-45322: Use-after-free in libxml2 through 2.11.5 was published today.  It reports:

 > libxml2 through 2.11.5 has a use-after-free that can only occur after a
 > certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c.
 > NOTE: the vendor's position is "I don't think these issues are critical
 > enough to warrant a CVE ID ... because an attacker typically can't control
 > when memory allocations fail."

The reproducer is attached to the upstream bug report at:
and is run via
"./libxml2/xmllint --copy --html --maxmem 315229 input.xml"

The fix is in the git master branch, but not yet any release:

         -Alan Coopersmith-       
          Oracle Solaris Engineering -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.