Summary
It was discovered that Expat, contained within the xmltok library,
incorrectly handled malformed XML data. If a user or application were
tricked into opening a crafted XML file, an attacker could cause a denial
of service, or possibly execute arbitrary code. (CVE-2015-1283,
CVE-2016-0718, CVE-2016-4472, CVE-2019-15903)
It was discovered that Expat, contained within the xmltok library,
incorrectly handled XML data containing a large number of colons, which
could lead to excessive resource consumption. If a user or application
were tricked into opening a crafted XML file, an attacker could possibly
use this issue to cause a denial of service. (CVE-2018-20843)
It was discovered that Expat, contained within the xmltok library,
incorrectly handled certain input, which could lead to an integer
overflow. If a user or application were tricked into opening a crafted XML
file, an attacker could possibly use this issue to cause a denial of
service. (CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824,
CVE-2022-22825, CVE-2022-22826, CVE-2022-22827)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm4 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm4 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | libxmltok | 1.2-4.1ubuntu2.24.0.4.1+esm2 |
Vulnerabilities 12
-
Critical 9.8CVE-2022-22822 Public exploit
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.1CVE-2021-46143 Public exploit
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
-
High 7.5
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the X…
-
Medium 6.5
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing to…
-
Unscored —CVE-2015-1283 EPSS 18%
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2…
-
Unscored —CVE-2016-0718 EPSS 13%
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a …
-
Unscored —CVE-2016-4472 EPSS 12%
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attack…
References
-
report
https://ubuntu.com/security/CVE-2015-1283
-
report
https://ubuntu.com/security/CVE-2016-0718
-
report
https://ubuntu.com/security/CVE-2016-4472
-
report
https://ubuntu.com/security/CVE-2018-20843
-
report
https://ubuntu.com/security/CVE-2019-15903
-
report
https://ubuntu.com/security/CVE-2021-46143
-
report
https://ubuntu.com/security/CVE-2022-22822
-
report
https://ubuntu.com/security/CVE-2022-22823
-
report
https://ubuntu.com/security/CVE-2022-22824
-
report
https://ubuntu.com/security/CVE-2022-22825
-
report
https://ubuntu.com/security/CVE-2022-22826
-
report
https://ubuntu.com/security/CVE-2022-22827