Summary
It was discovered that Expat, vendored in XML-RPC, incorrectly handled
certain files. An attacker could possibly use this issue to cause a crash
or execute arbitrary code.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | xmlrpc-c | 1.33.06-0ubuntu1+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | xmlrpc-c | 1.33.14-1ubuntu1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | xmlrpc-c | 1.33.14-8ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | xmlrpc-c | 1.33.14-8ubuntu0.20.04.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | xmlrpc-c | 1.33.14-10ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | xmlrpc-c | 1.33.14-12ubuntu0.1~esm1 |
Vulnerabilities 2
-
Critical 9.8CVE-2022-25235 Public exploit
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…
-
Critical 9.8
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…