CVE-2023-45322

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.11.5 and earlier

Description The issue is related to a use-after-free vulnerability in the xmlUnlinkNode function, located in tree.c, which can occur after a certain memory allocation fails. This could potentially allow a remote attacker to cause a denial of service. The vendor has stated that they do not consider this issue critical enough to warrant a fix because an attacker typically cannot control when memory allocations fail.

Recommendations For libxml2 versions 2.11.5 and earlier, as a temporary workaround, consider disabling the xmlUnlinkNode function until a patch is available. Restrict access to the tree.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.