ALAS2-2023-2280 — Moderate: expat security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-25313: A flaw was found in expat. A stack exhaustion in doctype parsing could be triggered by a file with a large number of opening braces, resulting in a denial of service. CVE-2022-23990: Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Fixed packages 4

Release	Package	Fixed in
Amazon Linux · 2	expat	0:2.1.0-15.amzn2.0.3
Amazon Linux · 2	expat-debuginfo	0:2.1.0-15.amzn2.0.3
Amazon Linux · 2	expat-devel	0:2.1.0-15.amzn2.0.3
Amazon Linux · 2	expat-static	0:2.1.0-15.amzn2.0.3

Vulnerabilities 2

High 7.5

CVE-2022-23990 Public exploit

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

thunderbird firefox expat swish-e Debian Ubuntu Azure Linux Alpine

Jan 26, 2022
Medium 6.5

CVE-2022-25313 Public exploit

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022

References

web
https://alas.aws.amazon.com/cve/html/CVE-2022-23990.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-25313.html

Moderate: expat security update (Amazon Linux 2)

Summary

Fixed packages 4

Vulnerabilities 2

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…

References