Vulnerability CVE-2022-23852: Information

Description

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Severity: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-23852
Published: Jan. 24, 2022
Modified: Oct. 29, 2022
Error type identifier: CWE-190

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
expatsisyphus2.4.4-alt12.5.0-alt1ALT-PU-2022-1208-1294677Fixed
expatsisyphus_e2k2.4.4-alt12.5.0-alt1ALT-PU-2022-3934-1-Fixed
expatsisyphus_riscv642.4.4-alt12.5.0-alt1ALT-PU-2022-3982-1-Fixed
expatp102.5.0-alt12.5.0-alt1ALT-PU-2023-4144-2324220Fixed
expatp10_e2k2.5.0-alt12.5.0-alt1ALT-PU-2023-5082-1-Fixed
expatc10f12.5.0-alt12.5.0-alt1ALT-PU-2023-4120-1324221Fixed
expatc9f22.5.0-alt12.5.0-alt1ALT-PU-2023-4107-2324219Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://github.com/libexpat/libexpat/pull/550
  • Issue Tracking
  • Patch
  • Third Party Advisory
https://www.tenable.com/security/tns-2022-05
  • Third Party Advisory
DSA-5073
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20220217-0001/
  • Third Party Advisory
[debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
  • Mailing List
  • Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
  • Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
  • Third Party Advisory
GLSA-202209-24
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
      End excliding
      2.4.4

      Configuration 2

      cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
      cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
      cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
      End excliding
      8.15.3
      cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*
      Start including
      10.0.0
      End excliding
      10.1.1

      Configuration 3

      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
      cpe:2.3:a:oracle:communications_metasolv_solution:6.3.1:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*
      End excliding
      3.1
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.4.2
Back to top