RHSA-2022:1069 — Red Hat Security Advisory: expat security update

Fixed packages 15

Release	Package	Fixed in
Red Hat · RHEL 7 enterprise_linux:7::client	expat	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client	expat-debuginfo	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client	expat-devel	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client	expat-static	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode	expat-debuginfo	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode	expat-devel	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode	expat-static	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server	expat	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server	expat-debuginfo	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server	expat-devel	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server	expat-static	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation	expat	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation	expat-debuginfo	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation	expat-devel	0:2.1.0-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation	expat-static	0:2.1.0-14.el7_9

Vulnerabilities 12

Critical 9.8

CVE-2022-22822 Public exploit

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
Critical 9.8

CVE-2022-22823

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
Critical 9.8

CVE-2022-22824

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
Critical 9.8

CVE-2022-23852 Public exploit

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…

thunderbird firefox qt5-qtwebengine insighttoolkit4 Debian Ubuntu Azure Linux Alpine

Jan 24, 2022
Critical 9.8

CVE-2022-25235 Public exploit

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25236 Public exploit EPSS 35%

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25315 Public exploit

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022
High 8.8

CVE-2021-45960 Public exploit

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…

firefox insighttoolkit4 expat swish-e Debian Ubuntu Azure Linux Alpine

Jan 1, 2022
High 8.8

CVE-2022-22825

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.8

CVE-2022-22826

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.8

CVE-2022-22827

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.1

CVE-2021-46143 Public exploit

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

firefox insighttoolkit4 qtwebengine-opensource-src expat Debian Ubuntu Azure Linux Alpine

Jan 6, 2022

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044451
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044455
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044457
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044464
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044467
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044479
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044484
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044488
report
https://bugzilla.redhat.com/show_bug.cgi?id=2044613
report
https://bugzilla.redhat.com/show_bug.cgi?id=2056363
report
https://bugzilla.redhat.com/show_bug.cgi?id=2056366
report
https://bugzilla.redhat.com/show_bug.cgi?id=2056370
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1069.json
report
https://access.redhat.com/security/cve/CVE-2021-45960
advisory
https://www.cve.org/CVERecord?id=CVE-2021-45960
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-45960
article
https://github.com/libexpat/libexpat/issues/531
report
https://access.redhat.com/security/cve/CVE-2021-46143
advisory
https://www.cve.org/CVERecord?id=CVE-2021-46143
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-46143
article
https://github.com/libexpat/libexpat/issues/532
report
https://access.redhat.com/security/cve/CVE-2022-22822
advisory
https://www.cve.org/CVERecord?id=CVE-2022-22822
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-22822
article
https://github.com/libexpat/libexpat/pull/539
report
https://access.redhat.com/security/cve/CVE-2022-22823
advisory
https://www.cve.org/CVERecord?id=CVE-2022-22823
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-22823
report
https://access.redhat.com/security/cve/CVE-2022-22824
advisory
https://www.cve.org/CVERecord?id=CVE-2022-22824
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-22824
report
https://access.redhat.com/security/cve/CVE-2022-22825
advisory
https://www.cve.org/CVERecord?id=CVE-2022-22825
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-22825
report
https://access.redhat.com/security/cve/CVE-2022-22826
advisory
https://www.cve.org/CVERecord?id=CVE-2022-22826
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-22826
report
https://access.redhat.com/security/cve/CVE-2022-22827

Red Hat Security Advisory: expat security update

Fixed packages 15

Vulnerabilities 12

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

References