ALT-PU-2023-4107-2
Closed vulnerabilities
Published: 2022-01-10
BDU:2022-00800
Уязвимость функции defineAttribute файла xmlparse.c библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
Severity: CRITICAL (9.8)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-01-10
BDU:2022-00805
Уязвимость функции lookupl файла xmlparse.c библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2022-01-26
BDU:2022-00999
Уязвимость функции doProlog() библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
Severity: CRITICAL (9.8)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2021-12-30
BDU:2022-01003
Уязвимость функции storeAtts() библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-01-10
BDU:2022-01052
Уязвимость функции doProlog (xmlparse.c) библиотеки Expat, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Severity: HIGH (8.1)
Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-01-10
BDU:2022-01058
Уязвимость функции storeAtts (xmlparse.c) библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2022-01-10
BDU:2022-01059
Уязвимость функции nextScaffoldPart (xmlparse.c) библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.8)
Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2022-01-10
BDU:2022-01060
Уязвимость функции build_model (xmlparse.c) библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код
Severity: CRITICAL (9.8)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-02-21
BDU:2022-01062
Уязвимость функции copyString библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
Published: 2022-02-21
BDU:2022-01063
Уязвимость компонента xmltok_impl.c библиотеки Expat, позволяющая нарушителю выполнить произвольный код
Severity: CRITICAL (9.8)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-02-21
BDU:2022-01064
Уязвимость функции build_model библиотеки Expat, связанная с переполнением буфера в стеке, позволяющая нарушителю выполнить произвольный код
Severity: CRITICAL (9.8)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-02-21
BDU:2022-01065
Уязвимость компонента xmlparse.c библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
Severity: MEDIUM (5.3)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References:
Published: 2022-02-21
BDU:2022-01071
Уязвимость функции storeRawNames библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
Published: 2022-01-25
BDU:2022-01702
Уязвимость библиотеки синтаксического анализатора XML libexpat, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код
Severity: CRITICAL (9.8)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-01-10
BDU:2022-02823
Уязвимость функции addBinding() библиотеки Expat, позволяющая нарушителю выполнить произвольный код
Severity: CRITICAL (9.8)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-09-14
BDU:2023-02596
Уязвимость функции doContent файла xmlparse.c библиотеки синтаксического анализатора XML libexpat, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (8.1)
Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2022-10-24
BDU:2023-02688
Уязвимость функции XML_ExternalEntityParserCreate библиотеки синтаксического анализатора XML libexpat, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
Published: 2014-01-21
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2013-0340
expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Severity: MEDIUM (6.8)
References:
- [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion
- [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion
- 20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15
- 20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15
- 20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8
- 20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8
- 20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15
- 20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15
- 20210921 APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15
- 20210921 APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15
- 20210921 APPLE-SA-2021-09-20-2 watchOS 8
- 20210921 APPLE-SA-2021-09-20-2 watchOS 8
- 20210921 APPLE-SA-2021-09-20-3 tvOS 15
- 20210921 APPLE-SA-2021-09-20-3 tvOS 15
- 20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8
- 20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8
- 20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6
- 20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6
- 20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina
- 20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina
- 1028213
- 1028213
- [oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments
- [oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments
- [oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs
- [oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs
- 90634
- 90634
- 58233
- 58233
- [announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs
- [announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs
- [openoffice-users] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs
- [openoffice-users] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs
- GLSA-201701-21
- GLSA-201701-21
- https://support.apple.com/kb/HT212804
- https://support.apple.com/kb/HT212804
- https://support.apple.com/kb/HT212805
- https://support.apple.com/kb/HT212805
- https://support.apple.com/kb/HT212807
- https://support.apple.com/kb/HT212807
- https://support.apple.com/kb/HT212814
- https://support.apple.com/kb/HT212814
- https://support.apple.com/kb/HT212815
- https://support.apple.com/kb/HT212815
- https://support.apple.com/kb/HT212819
- https://support.apple.com/kb/HT212819
Published: 2022-01-01
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-45960
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://bugzilla.mozilla.org/show_bug.cgi?id=1217609
- https://bugzilla.mozilla.org/show_bug.cgi?id=1217609
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/issues/531
- https://github.com/libexpat/libexpat/issues/531
- https://github.com/libexpat/libexpat/pull/534
- https://github.com/libexpat/libexpat/pull/534
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220121-0004/
- https://security.netapp.com/advisory/ntap-20220121-0004/
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-01-06
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-46143
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
Severity: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/issues/532
- https://github.com/libexpat/libexpat/issues/532
- https://github.com/libexpat/libexpat/pull/538
- https://github.com/libexpat/libexpat/pull/538
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220121-0006/
- https://security.netapp.com/advisory/ntap-20220121-0006/
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-01-10
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-22822
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-01-10
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-22823
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-01-10
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-22824
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-01-10
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-22825
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-01-10
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-22826
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-01-10
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-22827
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Severity: HIGH (8.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-01-24
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-23852
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/550
- https://github.com/libexpat/libexpat/pull/550
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220217-0001/
- https://security.netapp.com/advisory/ntap-20220217-0001/
- DSA-5073
- DSA-5073
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-01-26
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-23990
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/551
- https://github.com/libexpat/libexpat/pull/551
- FEDORA-2022-88f6a3d290
- FEDORA-2022-88f6a3d290
- FEDORA-2022-d2abd0858e
- FEDORA-2022-d2abd0858e
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Published: 2022-02-16
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-25235
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/562
- https://github.com/libexpat/libexpat/pull/562
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Published: 2022-02-16
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-25236
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/561
- https://github.com/libexpat/libexpat/pull/561
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Published: 2022-02-18
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-25313
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References:
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/558
- https://github.com/libexpat/libexpat/pull/558
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Published: 2022-02-18
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-25314
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/560
- https://github.com/libexpat/libexpat/pull/560
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Published: 2022-02-18
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-25315
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/559
- https://github.com/libexpat/libexpat/pull/559
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Published: 2022-09-14
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-40674
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
Severity: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- https://github.com/libexpat/libexpat/pull/629
- https://github.com/libexpat/libexpat/pull/629
- https://github.com/libexpat/libexpat/pull/640
- https://github.com/libexpat/libexpat/pull/640
- [debian-lts-announce] 20220925 [SECURITY] [DLA 3119-1] expat security update
- [debian-lts-announce] 20220925 [SECURITY] [DLA 3119-1] expat security update
- FEDORA-2022-d93b3bd8b9
- FEDORA-2022-d93b3bd8b9
- FEDORA-2022-c68d90efc3
- FEDORA-2022-c68d90efc3
- FEDORA-2022-dcb1d7bcb1
- FEDORA-2022-dcb1d7bcb1
- FEDORA-2022-15ec504440
- FEDORA-2022-15ec504440
- FEDORA-2022-c22feb71ba
- FEDORA-2022-c22feb71ba
- GLSA-202209-24
- GLSA-202209-24
- GLSA-202211-06
- GLSA-202211-06
- https://security.netapp.com/advisory/ntap-20221028-0008/
- https://security.netapp.com/advisory/ntap-20221028-0008/
- DSA-5236
- DSA-5236
Published: 2022-10-24
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-43680
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- [oss-security] 20231228 CVE-2022-43680: Apache OpenOffice: "Use after free" fixed in libexpat
- [oss-security] 20231228 CVE-2022-43680: Apache OpenOffice: "Use after free" fixed in libexpat
- [oss-security] 20240103 CVE-2022-43680: Apache OpenOffice: "Use after free" fixed in libexpat
- [oss-security] 20240103 CVE-2022-43680: Apache OpenOffice: "Use after free" fixed in libexpat
- https://github.com/libexpat/libexpat/issues/649
- https://github.com/libexpat/libexpat/issues/649
- https://github.com/libexpat/libexpat/pull/616
- https://github.com/libexpat/libexpat/pull/616
- https://github.com/libexpat/libexpat/pull/650
- https://github.com/libexpat/libexpat/pull/650
- [debian-lts-announce] 20221028 [SECURITY] [DLA 3165-1] expat security update
- [debian-lts-announce] 20221028 [SECURITY] [DLA 3165-1] expat security update
- FEDORA-2022-3cf0e7ebc7
- FEDORA-2022-3cf0e7ebc7
- FEDORA-2022-ae2559a8f4
- FEDORA-2022-ae2559a8f4
- FEDORA-2022-49db80f821
- FEDORA-2022-49db80f821
- FEDORA-2022-c43235716e
- FEDORA-2022-c43235716e
- FEDORA-2022-f3a939e960
- FEDORA-2022-f3a939e960
- FEDORA-2022-5f1e2e9016
- FEDORA-2022-5f1e2e9016
- GLSA-202210-38
- GLSA-202210-38
- https://security.netapp.com/advisory/ntap-20221118-0007/
- https://security.netapp.com/advisory/ntap-20221118-0007/
- DSA-5266
- DSA-5266
Closed bugs
libexpat-devel: упакованы битые конфиги для cmake