The vulnerability of the `build_model` function in the Expat library, related to buffer overflow in the stack, allows an attacker to execute arbitrary code.

The vulnerability of the buildmodel function in the Expat library is related to an error in determining the boundaries during the buildmodel process. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the nextScaffoldPart function in the Expat library, related to integer overflow, allows an attacker to execute arbitrary code.

The vulnerability of the nextScaffoldPart function in the Expat library is related to integer overflow. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability in the xmlparse.c component of the Expat library allows a hacker to induce a service failure.

The vulnerability of the xmlparse.c component in the Expat library is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a specially crafted request...

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server due to Expat vulnerabilities

Summary There are multiple vulnerabilities in the Expat library affecting the IBM HTTP Server used by IBM WebSphere Application Server CVE-2021-45960, CVE-2022-22822, CVE-2022-23990, CVE-2022-22823, CVE-2022-23852, CVE-2022-22825, CVE-2021-46143, CVE-2022-22824, CVE-2022-22826, and CVE-2022-22827...

The vulnerability of the doProlog() function in the Expat library allows a hacker to cause a service failure.

The vulnerability of the doProlog function in the Expat library is related to integer overflow. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the storeAtts() function in the Expat library allows a hacker to trigger a service failure.

The vulnerability of the storeAtts function in the Expat library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

In Expat (aka libexpat) before 2.4.5 there is an integer overflow in storeRawNames.

...

CVE-2022-25235

A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor. Mitigation There i...

CVE-2022-25315

An integer overflow was found in expat. The issue occurs in storeRawNames by abusing the mbuffer expansion logic to allow allocations very close to INTMAX and out-of-bounds heap writes. This flaw can cause a denial of service or potentially arbitrary code execution. Mitigation There is no known...

CVE-2022-25313

A flaw was found in expat. A stack exhaustion in doctype parsing could be triggered by a file with a large number of opening braces, resulting in a denial of service. Mitigation There is no known mitigation other than restricting applications using the expat library from processing untrusted XML...

AZL-8625 CVE-2022-25315 affecting package expat for versions less than 2.4.8-1

In Expat aka libexpat before 2.4.5, there is an integer overflow in storeRawNames...

DEBIAN-CVE-2022-25314

In Expat aka libexpat before 2.4.5, there is an integer overflow in copyString...

AZL-8624 CVE-2022-25314 affecting package expat for versions less than 2.4.8-1

In Expat aka libexpat before 2.4.5, there is an integer overflow in copyString...

DEBIAN-CVE-2022-25313

In Expat aka libexpat before 2.4.5, an attacker can trigger stack exhaustion in buildmodel via a large nesting depth in the DTD element...

UBUNTU-CVE-2022-25313

In Expat aka libexpat before 2.4.5, an attacker can trigger stack exhaustion in buildmodel via a large nesting depth in the DTD element...

UBUNTU-CVE-2022-25314

In Expat aka libexpat before 2.4.5, there is an integer overflow in copyString...

UBUNTU-CVE-2022-25315

In Expat aka libexpat before 2.4.5, there is an integer overflow in storeRawNames...

AZL-44607 CVE-2022-25235 affecting package ogdi 4.1.1-3

xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context...

DEBIAN-CVE-2022-25235

xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context...

AZL-43681 CVE-2022-25235 affecting package ogdi 4.1.0-9

xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context...