Homepage

Use After Free The advisory has been revoked - it doesn't affect any version of package xmlrpc-c-c++  (opens in a new tab)

Threat Intelligence

EPSS
2.46% (84th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS8-XMLRPCCC-3104725
  • published4 Nov 2022
  • disclosed24 Oct 2022
Report a new vulnerability Found a mistake?

Introduced: 24 Oct 2022

CVE-2022-43680  (opens in a new tab)
CWE-416  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xmlrpc-c-c++ package and not the xmlrpc-c-c++ package as distributed by Centos.

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

References