1314 matches found
CVE-2022-23852
Expat (libexpat) contains a signed integer overflow in XML_GetBuffer when XML_CONTEXT_BYTES is nonzero (CVE-2022-23852). IV was observed in multiple advisories and bulletins; the issue can lead to arbitrary code execution or crash if exploited. A fix exists in expat 2.4.4 and later; affected dist...
CVE-2022-23852
Expat aka libexpat before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES...
libexpat 输入验证错误漏洞
libexpat is a streaming XML parser written in the C language. An input validation error vulnerability exists in Libexpat that stems from the product's XMLGetBuffer not effectively limiting the range of signed integers. An attacker could cause a buffer overflow by configuring a special XML byte. T...
Debian DSA-5047-1 : prosody - security update
The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5047 advisory. Matthew Wild discovered that the WebSockets code in Prosody, a lightweight Jabber/XMPP server, was susceptible to denial of service. For the oldstable distribution...
FreeBSD : Prosody XMPP server advisory 2022-01-13 (e3ec8b30-757b-11ec-922f-654747404482)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e3ec8b30-757b-11ec-922f-654747404482 advisory. - It was discovered that an internal Prosody library to load XML based on libexpat does not properly...
openSUSE 15 Security Update : prosody (openSUSE-SU-2022:0012-1)
The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2022:0012-1 advisory. - It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML...
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3 an integer overflow exists for m_groupSize.
...
PT-2022-4676 · Libexpat +2 · Libexpat +2
Name of the Vulnerable Software and Affected Versions: Prosody affected versions not specified Description: The issue is related to the implementation of the WebSocket server module for Jabber/XMPP in Prosody, which is associated with incorrect restriction of XML links to external objects. This c...
Denial Of Service (DoS)
libexpat is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization of boundary in storeAtts function in xmlparse.c leading to an integer overflow...
CVE-2022-22827
storeAtts in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
ALPINE-CVE-2022-22823
buildmodel in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
CVE-2022-22822
addBinding in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
CVE-2022-22824
defineAttribute in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
Integer overflow
defineAttribute in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
Expat和libexpat 输入验证错误漏洞
Expat is a fast streaming XML parser written in C. libexpat is a streaming XML parser written in C. A buffer overflow vulnerability exists in versions of Expat prior to 2.4.3, which stems from a boundary error in storeAtts in xmlparse.c when processing untrusted input. A remote attacker could...
CVE-2022-22823
buildmodel in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...
CVE-2022-22823
CVE-2022-22823 affects Expat (libexpat) with an integer overflow in build_model() in xmlparse.c, vulnerable prior to 2.4.3. The CVE is corroborated by multiple sources (e.g., ALAS2-2022-1809, ALSA-2022-7692) and Cloud Foundry USN references, all indicating Expat pre-2.4.3 contains the overflow is...
CVE-2022-22823
buildmodel in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...