[SECURITY] [DSA 5085-1] expat security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5085-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 22, 2022 https://www.debian.org/security/faq -...

Updated expat packages fix security vulnerability

Passing malformed 2- and 3-byte UTF-8 sequences e.g. from start tag names to the XML processing application on top of Expat can cause arbitrary damage e.g. code execution depending on how invalid UTF-8 is handled inside the XML processor; validation was not their job but Expat's. Exploits with co...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current expat Multiple Vulnerabilities (SSA:2022-050-01)

The version of expat installed on the remote host is prior to 2.4.3 / 2.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-050-01 advisory. - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a...

openSUSE: Security Advisory for expat (openSUSE-SU-2022:0498-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Ubuntu: Security Advisory (USN-5288-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Critical Photon OS Security Update - PHSA-2022-0445

Updates of 'vim', 'expat', 'go' packages of Photon OS have been released...

Expat integer overflow vulnerability (CNVD-2022-18353)

Expat is a fast streaming XML parser written in C. Expat is vulnerable to an integer overflow vulnerability that stems from an integer overflow in copyString. No detailed vulnerability details are currently available...

DSA-5085-1 expat - security update

Bulletin has no description...

Expat integer overflow vulnerability (CNVD-2022-18355)

Expat is a fast streaming XML parser written in C. An integer overflow vulnerability exists prior to Expat 2.4.5, which stems from the presence of an integer overflow in storeRawNames. No detailed vulnerability details are currently available...

openSUSE 15 Security Update : expat (openSUSE-SU-2022:0498-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0498-1 advisory. - Expat aka libexpat before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES...

Expat has an unspecified vulnerability (CNVD-2022-18354)

Expat is a fast streaming XML parser written in C. A security vulnerability existed prior to Expat 2.4.5, which could be exploited by an attacker to trigger stack exhaustion in buildmodel via a large nesting depth in the DTD element...

USN-5288-1 expat vulnerabilities

It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

USN-5288-1: Expat vulnerabilities

It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

CVE-2022-25236

A flaw was found in expat. Passing one or more namespace separator characters in the "xmlns:prefix" attribute values made expat send malformed tag names to the XML processor on top of expat. This issue causes arbitrary code execution depending on how unexpected cases are handled inside the XML...

CVE-2022-25235

A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor. Mitigation There i...

CVE-2022-25314

An integer overflow flaw was found in expat. This issue affects the encoding name parameter at the parser creation time, which is often hard-coded rather than user input, takes a value in the gigabytes to trigger, and on a 64-bit machine. This flaw can cause a denial of service. Mitigation There ...

CVE-2022-25315

An integer overflow was found in expat. The issue occurs in storeRawNames by abusing the mbuffer expansion logic to allow allocations very close to INTMAX and out-of-bounds heap writes. This flaw can cause a denial of service or potentially arbitrary code execution. Mitigation There is no known...

CVE-2022-25313

A flaw was found in expat. A stack exhaustion in doctype parsing could be triggered by a file with a large number of opening braces, resulting in a denial of service. Mitigation There is no known mitigation other than restricting applications using the expat library from processing untrusted XML...

Expat has an unspecified vulnerability (CNVD-2022-18357)

Expat is a fast streaming XML parser written in C. A security vulnerability existed prior to Expat 2.4.5, which could be exploited by attackers to insert namespace separators into namespace URIs...

Expat has an unspecified vulnerability (CNVD-2022-18356)

Expat is a fast streaming XML parser written in C. A security vulnerability exists in Expat prior to 2.4.5, which stems from a lack of certain encoding validations in xmltokimpl.c. No detailed vulnerability details are currently available...