CVE-2022-23308

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.13

Description The issue is related to a use-after-free of ID and IDREF attributes in the valid.c file of the libxml2 library, which is used for XML document analysis. This can be exploited by a remote attacker to execute arbitrary code by sending a specially crafted XML file.

Recommendations For versions prior to 2.9.13, update to version 2.9.13 or later to resolve the issue. As a temporary workaround, consider restricting the use of the valid.c file or the affected ID and IDREF attributes until a patch is available.