Summary
Tim Boddy, Gustavo Grieco and others discovered that Expat, that is
integrated in xmltok library, incorrectly handled certain files.
An attacker could possibly use these issues to cause a denial of
service, or possibly execute arbitrary code. These issues were only
addressed in Ubuntu 16.04 ESM. (CVE-2012-1148, CVE-2015-1283,
CVE-2016-0718, CVE-2016-4472, CVE-2018-20843, CVE-2019-15903,
CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824,
CVE-2022-22825, CVE-2022-22826, CVE-2022-22827)
It was discovered that Expat, that is integrated in xmltok library,
incorrectly handled encoding validation of certain files. An attacker
could possibly use this issue to cause a denial of service, or
possibly execute arbitrary code. (CVE-2022-25235)
It was discovered that Expat, that is integrated in xmltok library,
incorrectly handled namespace URIs of certain files. An attacker
could possibly use this issue to cause a denial of service, or
possibly execute arbitrary code. (CVE-2022-25236)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libxmltok | 1.2-3ubuntu0.16.04.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm1 |
Vulnerabilities 15
-
Critical 9.8CVE-2022-22822 Public exploit
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8CVE-2022-25235 Public exploit
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…
-
Critical 9.8
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…
-
High 8.8
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.1CVE-2021-46143 Public exploit
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
-
High 7.5
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the X…
-
Medium 6.5
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing to…
-
Unscored —
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers t…
-
Unscored —CVE-2015-1283 EPSS 18%
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2…
-
Unscored —CVE-2016-0718 EPSS 13%
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a …
-
Unscored —CVE-2016-4472 EPSS 12%
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attack…
References
-
report
https://ubuntu.com/security/CVE-2012-1148
-
report
https://ubuntu.com/security/CVE-2015-1283
-
report
https://ubuntu.com/security/CVE-2016-0718
-
report
https://ubuntu.com/security/CVE-2016-4472
-
report
https://ubuntu.com/security/CVE-2018-20843
-
report
https://ubuntu.com/security/CVE-2019-15903
-
report
https://ubuntu.com/security/CVE-2021-46143
-
report
https://ubuntu.com/security/CVE-2022-22822
-
report
https://ubuntu.com/security/CVE-2022-22823
-
report
https://ubuntu.com/security/CVE-2022-22824
-
report
https://ubuntu.com/security/CVE-2022-22825
-
report
https://ubuntu.com/security/CVE-2022-22826
-
report
https://ubuntu.com/security/CVE-2022-22827
-
report
https://ubuntu.com/security/CVE-2022-25235
-
report
https://ubuntu.com/security/CVE-2022-25236