Rocky Linux 8 : xmlrpc-c (RLSA-2022:1643)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1643 advisory. - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain contex...

Rocky Linux 8 : expat (RLSA-2022:6878)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:6878 advisory. - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. CVE-2022-40674 Note that Nessus has not tested for this issue but has inste...

Medium: expat

Issue Overview: Expat aka libexpat before 2.4.4 has an integer overflow in the doProlog function. CVE-2022-23990 Affected Packages: expat Issue Correction: Run yum update expat or yum update --advisory ALAS-2023-1882 to update your system. New Packages: i686: expat-devel-2.1.0-15.34.amzn1.i686...

Ubuntu 16.04 ESM : VTK vulnerabilities (USN-4852-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4852-1 advisory. It was discovered that VTK incorrectly handled certain XML files in the embedded Expat library. An attacker could possibly use this issue to cause a deni...

Ubuntu 18.04 LTS : Thunderbird vulnerabilities (USN-4202-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4202-1 advisory. It was discovered that a specially crafted S/MIME message with an inner encryption layer could be displayed as having a valid signature in some...

Ubuntu 16.04 ESM : Coin3D vulnerability (USN-4825-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4825-1 advisory. USN-3356-1 fix a vulnerability in Expat. This update provides the corresponding update for Coin3D for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted...

Security Bulletin: IBM Security Verify Access Appliance has multiple security vulnerabilities

Summary There are multiple Security Vulnerabilities that were reported against the IBM Security Verify Access ISVA Appliance. These vulnerabilities have been addressed in the ISVA Appliance. Vulnerability Details CVEID:CVE-2022-4415 DESCRIPTION: systemd could allow a local authenticated attacker ...

ROS-20230911-03

A vulnerability in the XMLExternalEntityParserCreate function of the XML parser library libexpat is related to a post-release exploit. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

OESA-2023-1465 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc misbehavior e.g., allocating too few...

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion

In Expat aka libexpat before 2.4.5, an attacker can trigger stack exhaustion in buildmodel via a large nesting depth in the DTD element...

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation (CVE-2022-25235)

xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context...

OESA-2023-1454 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: addBinding in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow.CVE-2022-22822 buildmodel in xmlparse.c in Expat aka libexpat before 2.4.3 has an...

EulerOS Virtualization 3.0.6.6 : expat (EulerOS-SA-2023-2422)

According to the versions of the expat packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Expat aka libexpat before 2.4.5, an attacker can trigger stack exhaustion in buildmodel via a large nesting depth in the DTD...

Oracle HTTP Server (Jul 2023 CPU)

The version of Oracle HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the Jul 2023 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: Thirdparty LibExpat. The supported version that is affected ...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to libexpat denial of service( CVE-2022-43680)

Summary Potential libexpat denial of service vulnerability CVE-2022-43680 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-43680 DESCRIPTION: libexpat is vulnerable to a denial of...

Security Bulletin: Oracle Outside In Technology (OIT) Security Vulnerabilities

Summary Oracle Outside In Technology OIT Security Vulnerabilities resolved in January 2023 Critical Patch Update. Vulnerability Details CVEID:CVE-2022-27404 DESCRIPTION: FreeType is vulnerable to a buffer overflow, caused by improper bounds checking in sfntinitface function. By persuading a victi...

Security Bulletin: Oracle Outside In Technology (OIT) Security Vulnerabilities

Summary Oracle Outside In Technology OIT Security Vulnerabilities resolved in January 2023 Critical Patch Update. Vulnerability Details CVEID:CVE-2022-27404 DESCRIPTION: FreeType is vulnerable to a buffer overflow, caused by improper bounds checking in sfntinitface function. By persuading a victi...

Advisory ROSA-SA-2023-2168

Software: firefox 102.10.0 OS: rosa-server79 packageevrstring: 102.10.0-1.res7 CVE-ID: CVE-2022-40674 BDU-ID: 2023-02596 CVE-Crit: HIGH CVE-DESC: A vulnerability in the doContent function of the xmlparse.c file of the libexpat XML parser library is related to a post-release exploit. Exploitation ...

Advisory ROSA-SA-2023-2166

Software: thunderbird 102.10.0 OS: rosa-server79 packageevrstring: 102.10.0-2.res7 CVE-ID: CVE-2022-40674 BDU-ID: 2023-02596 CVE-Crit: HIGH CVE-DESC: A vulnerability in the doContent function of the xmlparse.c file of the libexpat XML parser library is related to a post-release exploit...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2023-2219)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...