CVE-2022-40304
Published on: Not Yet Published
Last Modified on: 02/23/2023 10:20:00 PM UTC
Certain versions of Ipados from Apple contain the following vulnerability:
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.
- CVE-2022-40304 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity.
CVSS3 Score: 7.8 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| LOCAL | LOW | NONE | REQUIRED |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| About the security content of watchOS 9.2 - Apple Support | support.apple.com text/html |
CONFIRM support.apple.com/kb/HT213536 |
| About the security content of iOS 15.7.2 and iPadOS 15.7.2 - Apple Support | support.apple.com text/html |
CONFIRM support.apple.com/kb/HT213531 |
| About the security content of macOS Big Sur 11.7.2 - Apple Support | support.apple.com text/html |
CONFIRM support.apple.com/kb/HT213534 |
| About the security content of macOS Monterey 12.6.2 - Apple Support | support.apple.com text/html |
CONFIRM support.apple.com/kb/HT213533 |
| Full Disclosure: APPLE-SA-2022-12-13-2 iOS 15.7.2 and iPadOS 15.7.2 | seclists.org text/html |
FULLDISC 20221220 APPLE-SA-2022-12-13-2 iOS 15.7.2 and iPadOS 15.7.2 |
| About the security content of tvOS 16.2 - Apple Support | support.apple.com text/html |
CONFIRM support.apple.com/kb/HT213535 |
| Full Disclosure: APPLE-SA-2022-12-13-6 macOS Big Sur 11.7.2 | seclists.org text/html |
FULLDISC 20221220 APPLE-SA-2022-12-13-6 macOS Big Sur 11.7.2 |
| Full Disclosure: APPLE-SA-2022-12-13-5 macOS Monterey 12.6.2 | seclists.org text/html |
FULLDISC 20221220 APPLE-SA-2022-12-13-5 macOS Monterey 12.6.2 |
| November 2022 Libxml2 Vulnerabilities in NetApp Products | NetApp Product Security | security.netapp.com text/html |
CONFIRM security.netapp.com/advisory/ntap-20221209-0003/ |
| [CVE-2022-40304] Fix dict corruption caused by entity reference cycles (1b41ec4e) · Commits · GNOME / libxml2 · GitLab | gitlab.gnome.org text/html |
MISC gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b |
| v2.10.3 · Tags · GNOME / libxml2 · GitLab | gitlab.gnome.org text/html |
MISC gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3 |
| Tags · GNOME / libxml2 · GitLab | gitlab.gnome.org text/html |
MISC gitlab.gnome.org/GNOME/libxml2/-/tags |
| No Description Provided | seclists.org Inactive LinkNot Archived |
FULLDISC 20221220 APPLE-SA-2022-12-13-7 tvOS 16.2 |
Related QID Numbers
- 160396 Oracle Enterprise Linux Security Update for libxml2 (ELSA-2023-0173)
- 160413 Oracle Enterprise Linux Security Update for libxml2 (ELSA-2023-0338)
- 181179 Debian Security Update for libxml2 (DLA 3172-1)
- 181192 Debian Security Update for libxml2 (DSA 5271-1)
- 199063 Ubuntu Security Notification for libxml2 Vulnerabilities (USN-5760-1)
- 241064 Red Hat Update for libxml2 (RHSA-2023:0173)
- 241093 Red Hat Update for libxml2 (RHSA-2023:0338)
- 283234 Fedora Security Update for libxml2 (FEDORA-2022-aeafd24818)
- 283465 Fedora Security Update for libxml2 (FEDORA-2022-a6812b0224)
- 330130 IBM AIX Arbitrary Code Execution Vulnerability in libxml2 (libxml2_advisory3)
- 354430 Amazon Linux Security Advisory for libxml2 : ALAS2022-2022-258
- 354487 Amazon Linux Security Advisory for xmlsec1 : ALAS2022-2022-257
- 354559 Amazon Linux Security Advisory for xmlsec1 : ALAS-2022-257
- 354560 Amazon Linux Security Advisory for libxml2 : ALAS-2022-258
- 354834 Amazon Linux Security Advisory for libxml2 : ALAS2-2023-1996
- 354929 Amazon Linux Security Advisory for libxml2 : ALAS-2023-1743
- 355209 Amazon Linux Security Advisory for libxml2 : ALAS2023-2023-096
- 355268 Amazon Linux Security Advisory for xmlsec1 : ALAS2023-2023-097
- 377762 Apple MacOS Ventura 13.0.1 Not Installed (HT213504)
- 377831 Apple macOS Monterey 12.6.2 Not Installed (HT213533)
- 377832 Apple macOS Big Sur 11.7.2 Not Installed (HT213534)
- 377902 Alibaba Cloud Linux Security Update for libxml2 (ALINUX3-SA-2023:0008)
- 378433 Oracle Hypertext Transfer Protocol Server (HTTP Server) Server Multiple Vulnerabilities (CPUAPR2023)
- 502547 Alpine Linux Security Update for libxml2
- 502741 Alpine Linux Security Update for libxml2
- 610450 Apple iOS 16.1.1 and iPadOS 16.1.1 Security Update Missing
- 610455 Apple iOS 15.7.2 and iPadOS 15.7.2 Security Update Missing
- 672422 EulerOS Security Update for libxml2 (EulerOS-SA-2022-2800)
- 672493 EulerOS Security Update for libxml2 (EulerOS-SA-2023-1016)
- 672514 EulerOS Security Update for libxml2 (EulerOS-SA-2023-1041)
- 672550 EulerOS Security Update for libxml2 (EulerOS-SA-2023-1130)
- 672571 EulerOS Security Update for libxml2 (EulerOS-SA-2023-1106)
- 672616 EulerOS Security Update for libxml2 (EulerOS-SA-2023-1393)
- 672665 EulerOS Security Update for libxml2 (EulerOS-SA-2023-1365)
- 672769 EulerOS Security Update for libxml2 (EulerOS-SA-2023-1510)
- 710675 Gentoo Linux libxml2 Multiple Vulnerabilities (GLSA 202210-39)
- 752695 SUSE Enterprise Linux Security Update for libxml2 (SUSE-SU-2022:3692-1)
- 752722 SUSE Enterprise Linux Security Update for libxml2 (SUSE-SU-2022:3717-1)
- 752764 SUSE Enterprise Linux Security Update for libxml2 (SUSE-SU-2022:3871-1)
- 904575 Common Base Linux Mariner (CBL-Mariner) Security Update for libxml2 (11505)
- 904587 Common Base Linux Mariner (CBL-Mariner) Security Update for libxml2 (11500)
- 904623 Common Base Linux Mariner (CBL-Mariner) Security Update for libxml2 (11505-1)
- 904631 Common Base Linux Mariner (CBL-Mariner) Security Update for libxml2 (11500-1)
- 940884 AlmaLinux Security Update for libxml2 (ALSA-2023:0173)
- 940901 AlmaLinux Security Update for libxml2 (ALSA-2023:0338)
- 960535 Rocky Linux Security Update for libxml2 (RLSA-2023:0173)
- 960547 Rocky Linux Security Update for libxml2 (RLSA-2023:0338)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Apple | Ipados | All | All | All | All |
| Operating System | Apple | Iphone Os | All | All | All | All |
| Operating System | Apple | Macos | All | All | All | All |
| Operating System | Apple | Tvos | All | All | All | All |
| Operating System | Apple | Watchos | All | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Clustered Data Ontap | - | All | All | All |
| Application | Netapp | Clustered Data Ontap Antivirus Connector | - | All | All | All |
| Hardware
| Netapp | H300s | - | All | All | All |
| Operating System | Netapp | H300s Firmware | - | All | All | All |
| Hardware
| Netapp | H410c | - | All | All | All |
| Operating System | Netapp | H410c Firmware | - | All | All | All |
| Hardware
| Netapp | H410s | - | All | All | All |
| Operating System | Netapp | H410s Firmware | - | All | All | All |
| Hardware
| Netapp | H500s | - | All | All | All |
| Operating System | Netapp | H500s Firmware | - | All | All | All |
| Hardware
| Netapp | H700s | - | All | All | All |
| Operating System | Netapp | H700s Firmware | - | All | All | All |
| Application | Netapp | Manageability Software Development Kit | - | All | All | All |
| Application | Netapp | Smi-s Provider | - | All | All | All |
| Application | Netapp | Snapmanager | - | All | All | All |
| Application | Xmlsoft | Libxml2 | All | All | All | All |
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*:
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*:
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*:
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*:
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*:
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*:
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*:
- cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @OpenBSD_ports |
[email protected] modified textproc/libxml: SECURITY update to libxml-2.10.3 - [CVE-2022-40304] Fix dict corruption caused… twitter.com/i/web/status/1… | 2022-10-15 12:55:18 |
| @OpenBSD_ports |
OPENBSD_7_2 [email protected] modified textproc/libxml: SECURITY update to libxml-2.10.3 - [CVE-2022-40304] Fix dict corru… twitter.com/i/web/status/1… | 2022-10-15 12:55:19 |
| @OpenBSD_stable |
OPENBSD_7_2 [email protected] modified textproc/libxml: SECURITY update to libxml-2.10.3 - [CVE-2022-40304] Fix dict corru… twitter.com/i/web/status/1… | 2022-10-15 12:55:19 |
| @OpenBSD_ports |
OPENBSD_7_1 [email protected] changed textproc/libxml: Merge SECURITY fixes from upstream: - [CVE-2022-40304] Fix dict cor… twitter.com/i/web/status/1… | 2022-10-15 12:55:20 |
| @OpenBSD_stable |
OPENBSD_7_1 [email protected] changed textproc/libxml: Merge SECURITY fixes from upstream: - [CVE-2022-40304] Fix dict cor… twitter.com/i/web/status/1… | 2022-10-15 12:55:21 |
| @autumn_good_35 |
CVE-2022-37434 CVE-2022-40303 CVE-2022-40304 ClamAV® blog: New packages for ClamAV 0.103.7, 0.104.4, 0.105.1 to res… twitter.com/i/web/status/1… | 2022-11-01 15:09:30 |
| @0xdea |
[CVE-2022-40304] Double-free when parsing default attributes // by @NedWilliamson gitlab.gnome.org/GNOME/libxml2/… | 2022-11-10 06:14:41 |
| @the_yellow_fall |
CVE-2022-40303 & CVE-2022-40304: RCE flaws in Apple iOS, macOS securityonline.info/cve-2022-40303… #opensource #infosec #security #pentesting | 2022-11-11 06:54:54 |
| @AcooEdi |
CVE-2022-40303 & CVE-2022-40304: RCE flaws in Apple iOS, macOS dlvr.it/ScbFD0 via securityonline https://t.co/pn5R9O4Aoy | 2022-11-11 06:58:35 |
| @lucianot54 |
"CVE-2022-40303 & CVE-2022-40304: RCE flaws in Apple iOS, macOS" via Penetration Testing ift.tt/6pKoB2S | 2022-11-11 07:17:18 |
| @FilipiPires |
CVE-2022-40303 & CVE-2022-40304: RCE flaws in Apple iOS, macOS ift.tt/q1FI2sD #security #opensource… twitter.com/i/web/status/1… | 2022-11-11 07:33:40 |
| @Dinosn |
CVE-2022-40303 & CVE-2022-40304: RCE flaws in Apple iOS, macOS securityonline.info/cve-2022-40303… | 2022-11-11 07:40:09 |
| @Komodosec |
#Vulnerability #Apple CVE-2022-40303 & CVE-2022-40304: RCE flaws in Apple iOS, macOS securityonline.info/cve-2022-40303… | 2022-11-11 11:05:32 |
| @PentestingN |
CVE-2022-40303 & CVE-2022-40304: RCE flaws in Apple iOS, macOS securityonline.info/cve-2022-40303… Penetration Testing CVE-20… twitter.com/i/web/status/1… | 2022-11-11 11:13:43 |
| @ernered |
CVE-2022-40303 & CVE-2022-40304: RCE flaws in Apple iOS, macOS securityonline.info/cve-2022-40303… #technology #feedly | 2022-11-13 16:05:38 |
| @hagieee |
iOS/iPadOS 1.6.1.1リリース libxml2の脆弱性(CVE-2022-40303, CVE-2022-40304) 2件が修正 support.apple.com/ja-jp/HT213505 | 2022-11-14 04:48:10 |
| @iototsecnews |
macOS／iOS のリモート・コード実行の脆弱性が FIX：CVE-2022-40303／CVE-2022-40304 #security #apple #vulnerability iototsecnews.jp/2022/11/10/app… | 2022-11-19 22:08:46 |
| @CVEreport |
CVE-2022-40304 : An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corru… twitter.com/i/web/status/1… | 2022-11-23 18:05:41 |
 /r/k12cybersecurity |
MS-ISAC CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution - PATCH: NOW | 2022-11-10 12:55:52 |
| /r/netcve |
CVE-2022-40304 | 2022-11-23 18:38:35 |
| /r/DailyCVE |
CVE-2022-40304 | 2022-11-23 20:16:08 |
| /r/k12cybersecurity |
MS-ISAC CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution - PATCH: NOW | 2022-12-14 15:20:38 |
| /r/googlecloudupdates |
May 02, 2023 GCP release notes | 2023-05-03 01:00:28 |