Hi,

The following vulnerability was published for libxml2.

CVE-2022-29824[0]:
| In libxml2 before 2.9.14, several buffer handling functions in buf.c
| (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows.
| This can result in out-of-bounds memory writes. Exploitation requires
| a victim to open a crafted, multi-gigabyte XML file. Other software
| using libxml2's buffer functions, for example libxslt through 1.1.35,
| is affected as well.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-29824
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824
[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

I'm uploading 2.9.14 in a few minutes, taking care of this for unstable
and bookworm, but if you believe this bug deserves to be fixed through
-security, I'd ask if you can take care of that yourselves.

Otherwise I'll submit a pu next week.

We believe that the bug you reported is fixed in the latest version of
libxml2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1010526@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mattia Rizzolo <mattia@debian.org> (supplier of updated libxml2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 05 May 2022 14:43:51 +0200
Source: libxml2
Architecture: source
Version: 2.9.14+dfsg-1
Distribution: unstable
Urgency: high
Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
Changed-By: Mattia Rizzolo <mattia@debian.org>
Closes: 1010526
Changes:
 libxml2 (2.9.14+dfsg-1) unstable; urgency=high
 .
   * Team upload.
   * New upstream version 2.9.14+dfsg.
     + Integer overflows in xmlBuf/xmlBuffer.  CVE-2022-29824 Closes: #1010526
Checksums-Sha1:
 8429b8bb146e769de5ddde76604625c0cadc3238 2915 libxml2_2.9.14+dfsg-1.dsc
 b41615e638174b4e36845c68d4b305dd6a6b541f 2351200 libxml2_2.9.14+dfsg.orig.tar.xz
 6f34e85ab2a7a69939d63f114508355792d19772 28664 libxml2_2.9.14+dfsg-1.debian.tar.xz
 77585c2c8ef6d57131de7d21d64b7c33b3840c96 9305 libxml2_2.9.14+dfsg-1_amd64.buildinfo
Checksums-Sha256:
 560b526a9b445b239eedac460cb7554e4e9aeaea5cf6a7c669dae08e3d4c14a5 2915 libxml2_2.9.14+dfsg-1.dsc
 4fe913dec8b1ab89d13b489b419a8203176ea39e931eaa0d25b17eafb9c279e9 2351200 libxml2_2.9.14+dfsg.orig.tar.xz
 6d563feb4a3f79c5e704703264bc4c06afd6fb30176a85afaba3549e3bef2a28 28664 libxml2_2.9.14+dfsg-1.debian.tar.xz
 09a9c90e2a5c94ac5985cdb739e08db298bbaa7daec8554e33d4c306abc14800 9305 libxml2_2.9.14+dfsg-1_amd64.buildinfo
Files:
 b2eb0a3aa5ad7ee9d22c42e93c9c48f6 2915 libs optional libxml2_2.9.14+dfsg-1.dsc
 bbcae2f48d1c9b1413ef953ce87e9346 2351200 libs optional libxml2_2.9.14+dfsg.orig.tar.xz
 d36d0dc977d8564c7a6945cc2eeaff3c 28664 libs optional libxml2_2.9.14+dfsg-1.debian.tar.xz
 2be9224d463dde28a3ff31527930dd26 9305 libs optional libxml2_2.9.14+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAmJzyMIACgkQCBa54Yx2
K60+RA/+NZc4vKOcYMorlMrbJOXj9ywJZEIZFi4LjEtyCBfMG8m8hJxhtDrmCydL
e9Y65rry1g1C39chSM1VrW9ckUkZ9CgokOa0V8gKM/A7EIDfyLjxx4dWHKAJ0rPM
vd8hY3LGOxb5WCjHG4PNE4TAR8ZbB1hIJyUboGvBREfAbN7P+NQ0p0pF41JzDCG2
bLze03Wcc5bGWKRBwuptsHfQJBYuwHC1ut1tnizwGzU24/eol66xdsuj30bLaCKd
VFyLMsQ9DDQH5Jn/03+mKQKx7sYeWrO5ZRfe+heJ+Lpwr1wVepvgk4whJt7ZseS3
BWdK0DwKimKre+Ntm2/Oe2W70NFE39SWET1Rnayr9zGTIoDEnkLUMLvgekUAJs+v
PUtuSQavQaWUoAu+KmeqKPvX6x8VgQPLYG4PvOrN3aAi1X2K6BE7Yl3wcXbRpW6P
PpyzWIVDB8CokVTwJvTIwZn5NU6ztTOY3IQNT22jzkzy82tZBuHZp5zORrxoUrTc
B1f3KxrwBlwbLteb9zeKaczVvXAlaweG6GmeJdHdL9cuyyluYrlriwSWbx/QKP9+
IKZ5wssfjQ4acVLps6z9BmA8JJzE5VhiCe9QlofDQLLTwoZDjemyJNFsfimz3Ujg
vuzWX7+puvx6UVrLGYbsxhzqi6EpV7GNs/LU4tEX8EOEj39dcy4=
=25Cq
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
libxml2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1010526@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libxml2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 15 May 2022 15:58:46 +0200
Source: libxml2
Architecture: source
Version: 2.9.10+dfsg-6.7+deb11u2
Distribution: bullseye-security
Urgency: high
Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1010526
Changes:
 libxml2 (2.9.10+dfsg-6.7+deb11u2) bullseye-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix integer overflow in xmlBufferResize
   * Fix integer overflows in xmlBuf and xmlBuffer (CVE-2022-29824)
     (Closes: #1010526)
Checksums-Sha1:
 40219fa9419ee3943645f9fc5bfefb81e1e37fbe 2859 libxml2_2.9.10+dfsg-6.7+deb11u2.dsc
 2578c0817feae47d78c4f987c7a2a32f87d89517 2503560 libxml2_2.9.10+dfsg.orig.tar.xz
 3c302997948f3789fc90f82a75404fa229eebbf9 36368 libxml2_2.9.10+dfsg-6.7+deb11u2.debian.tar.xz
Checksums-Sha256:
 f80a2929c91dc06cfa84e7e555d5d76c9b9df848d9b3e561e59f1338417feba3 2859 libxml2_2.9.10+dfsg-6.7+deb11u2.dsc
 65ee7a2f5e100c64ddf7beb92297c9b2a30b994a76cd1fab67470cf22db6b7d0 2503560 libxml2_2.9.10+dfsg.orig.tar.xz
 76bb4df309fbb02b26a6d5ab1bc32e158c709f0e7fb255ec734be5efe3cb78d5 36368 libxml2_2.9.10+dfsg-6.7+deb11u2.debian.tar.xz
Files:
 4b0bca460d95dc492e8d5a47f1fadf7f 2859 libs optional libxml2_2.9.10+dfsg-6.7+deb11u2.dsc
 4fb60521425df67f453b3c1ff0efbc1c 2503560 libs optional libxml2_2.9.10+dfsg.orig.tar.xz
 0a80fb4f837efc502ccae0024b3b3338 36368 libs optional libxml2_2.9.10+dfsg-6.7+deb11u2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmKBCChfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EeSsP/j1A3BTBAp1Q6DMpx5uyq2I9cwx2WGE8
GH3x6lCpKaVdlsj17nIlk5plNqlbLzfNaXGqyxk5U66E8dU0oF+zopqH5hI/sfZh
hOw/y9CW7eck8edgd6WH69HoG3a9o8taohKojjkrdCQHd+IHd4Fiat9ztDDjFnCE
Fk2IEgMV7y2LHUcbrJXXwAPD8NZJl7XdiV2UwUMkfNiAnLQkpJq91YHHhsot3Zh5
QwcVqNcZJiDtyGbn50hYRiSXdAPtrTtbpSmjbv+gFjM5o5RRWcNG0DPvnGLGq4vH
03ceb4vcLDe5thFSAmgVKOu7P6UoGnBaeWlz29IaMRUt5zTarR8eBCmdYkSr8Elw
+NYX8XopcnPkmoUPHseX9LSjx1O2TJY9W3vV8VqaXiyA0cTV4Wkq0p+GZVfXVqIj
RLiOMFQcaxYlHPiJZovh+AoVpnYopMeC6chPrbVrjj9DJFFGwXVYgZGNYpxbq8oj
8wIruJra1Fzdvz7EneBchj22OJV7V48XIqQiryj9u3aM8tAz97K91xCnOVqX6SNL
DYYzk0WkQEPEF9RfFBBHnaXxYFIHaGbUChxpkmlNsqW54UOJUBgzcX6+DYCmLUeh
/haVxJ6d0RjeB2praBv32PVSTPzgvJIli8PmyyLcnP0Cjx5ubeBMeCwY3FVNFlhg
4aKx/uhqPfJB
=WiTA
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
libxml2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1010526@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libxml2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 15 May 2022 16:13:21 +0200
Source: libxml2
Architecture: source
Version: 2.9.4+dfsg1-7+deb10u4
Distribution: buster-security
Urgency: high
Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1010526
Changes:
 libxml2 (2.9.4+dfsg1-7+deb10u4) buster-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix integer overflow in xmlBufferResize
   * Fix integer overflows in xmlBuf and xmlBuffer (CVE-2022-29824)
     (Closes: #1010526)
Checksums-Sha1:
 4d87fc4fc52c540714d5e7754ed604e9c51cc7c9 3163 libxml2_2.9.4+dfsg1-7+deb10u4.dsc
 ca9a4f7f1eab2b69ead6174885a5e6b1629ec956 2446412 libxml2_2.9.4+dfsg1.orig.tar.xz
 bdb8be2b5f6bddf8d392252f1cdd676d659a41a0 44728 libxml2_2.9.4+dfsg1-7+deb10u4.debian.tar.xz
Checksums-Sha256:
 76c5b2edeb11a39e261de86603c43ea0adc65948f04f54fbd7be39bc726655a6 3163 libxml2_2.9.4+dfsg1-7+deb10u4.dsc
 a74ad55e346aa0b2b41903e66d21f8f3d2a736b3f41e32496376861ab484184e 2446412 libxml2_2.9.4+dfsg1.orig.tar.xz
 68f97766c8c8b161bd99f372a4056fd8bcdabd6e54ed496409cf33d6b3a87d11 44728 libxml2_2.9.4+dfsg1-7+deb10u4.debian.tar.xz
Files:
 68375e62008b8e8ddd51b1e69ad2f495 3163 libs optional libxml2_2.9.4+dfsg1-7+deb10u4.dsc
 3ced197721416e7e2f13b0f4e0f1185b 2446412 libs optional libxml2_2.9.4+dfsg1.orig.tar.xz
 37aad19f71b4c7b8a64ba24f4d59f7c6 44728 libs optional libxml2_2.9.4+dfsg1-7+deb10u4.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmKBC15fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E4LcQAJaL/MdkQTdQIMyIeQZBkGkDWhS3Y7Pe
ar6lBYA96QFhWA+ucMzHCX+54XcZQv3l0sysnXMu/YQU1qM43X0RCO35X2jitpxx
yHGdIpyh6sAiefLpZzWjDEzIUFi/6/0l/PRSY8AsolO8My4jWSjrvS4yJ9CaTmUE
CtRYo1doyOzllvePc2icmZVJSDhfTW9F5kOsFOQ0v+Q88w5fDbBp7f+HsnLb74pk
s/oJT0//klpD2j+jNGZqRvcCOYpZg+G5DgklE1hEhiBZ6Yj45ur9cCMPuXf39Rfg
wQLem199MRT1+KQMyFPwY2C29VeHPfKDF67Ug/wIKEO1JnKvDC2pEBsGBQwwNGtG
SPRYJM4FPiKNei3g9bLCgmQC+ZtG54PNJzB5jM2n7LmwF0RmqficMzU3XGJlZrtp
sZ3TJq3o3pnJYqEyy9cpM2+TjIrJpSUdfNBn/Txmhl9JsfLyhE2cdlWodUP9CONK
LaEWp5dfsN9O4S65a+2t3oSl0qU+QiWVGUXo/3loR1V9Tjn7mpijx1WIhCd/oZOa
sCX+GbhuBmMwAhDcCM2GNKP6pzBW71rBqUUeoMhmtXbHDA+/nqKxVYTwtcImMvCD
GkFZhMXGv86lv28xZRob17pf+OfKVwgvLUjzIUQFByDBkS4OKghuWHG8FRUl8uFJ
HMQVlGxT9zB7
=woq5
-----END PGP SIGNATURE-----