Summary
[2.2.5-10.0.1]
- lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314]
[2.2.5-10.1]
- CVE-2022-43680 expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
- Resolves: CVE-2022-43680
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | expat | 0:2.2.5-10.0.1.el8_7.1 |
| Oracle Linux · 8 | expat-devel | 0:2.2.5-10.0.1.el8_7.1 |
Vulnerabilities 1
-
High 7.5CVE-2022-43680 Public exploit
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…