Medium ELSA-2022-5314 2 CVEs

Moderate: expat security update (Oracle Linux 8)

Published Jun 30, 2022 · Updated Jun 30, 2022

Ecosystem: Oracle Linux

Summary

[2.2.5-8.0.1.2]
- lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314]

[2.2.5-8.2]
- Improve fix for CVE-2022-25313
- Related: CVE-2022-25313

[2.2.5-8.1]
- Fix multiple CVEs
- Resolves: CVE-2022-25314
- Resolves: CVE-2022-25313

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 8	expat	0:2.2.5-8.0.1.el8_6.2
Oracle Linux · 8	expat-devel	0:2.2.5-8.0.1.el8_6.2

Vulnerabilities 2

High 7.5

CVE-2022-25314 Public exploit

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022
Medium 6.5

CVE-2022-25313 Public exploit

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022