Summary
[2.1.0-15.0.1]
- lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910302]
[2.1.0-15]
- Ensure raw tagnames are safe exiting internalEntityParser
- Resolves: CVE-2022-40674
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | expat | 0:2.1.0-15.0.1.el7_9 |
| Oracle Linux · 7 | expat-devel | 0:2.1.0-15.0.1.el7_9 |
| Oracle Linux · 7 | expat-static | 0:2.1.0-15.0.1.el7_9 |
Vulnerabilities 1
-
High 8.1
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.